A classic SQL injection flaw exists in the Sinturno application, specifically on the '/_adm/scripts/modalReport_data.php' endpoint. The vulnerability is triggered by the 'client' parameter and allows an attacker to read, create, modify, or delete database records. The flaw falls under CWE‑89, indicating unchecked user input is directly incorporated into SQL statements, compounding risk to confidentiality and integrity. If exploited, an attacker could exfiltrate sensitive data or corrupt database contents, undermining system reliability and trust.

The affected product is Sinturno by Sinturno, with all listed versions considered vulnerable. The CPE entry indicates that no specific version boundary protects against the issue, placing every deployed instance at risk until remediation is undertaken.

The CVSS score of 9.3 reflects a high severity, and although EPSS data is unavailable, the lack of listing in the CISA KEV catalog suggests no active exploitation is publicly documented. Nevertheless, the attack vector is likely via exposed web traffic: any user able to reach the vulnerable endpoint can supply malicious input in the 'client' parameter. Successful exploitation requires no special credentials per the description, meaning authentication is either unnecessary or limited to existing UI access privileges. The vulnerability therefore poses a significant threat if left unpatched, with the potential for full database compromise.