ResourceSpace 8.6 contains a flaw that allows an authenticated attacker to inject arbitrary SQL commands through the keywords field in collection_edit.php. By submitting specially crafted POST requests, an attacker can execute any database query, enabling the extraction of sensitive data such as schema names, user credentials, and other confidential information. The description clearly identifies the attack as a traditional SQL injection scenario; the CWE listed is 89, which corresponds to SQL Injection, confirming the nature of the vulnerability.

The vulnerability is specific to ResourceSpace version 8.6. No other versions are mentioned as affected, and the flaw is confined to the collection_edit.php component of that release.

The CVSS score of 7.1 classifies this flaw as high severity, reflecting the potential for significant data exposure once authenticated. The EPSS score is 0.00013, indicating exploitation probability below 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation evidence. Because the flaw requires an authenticated session, the risk is bounded to users who have legitimate, though possibly compromised, credentials. Once exploited, confidentiality is breached, and the ability to execute arbitrary queries could also allow data modification, affecting integrity.