This vulnerability is a classic SQL injection flaw that lets an attacker embed malicious SQL code through the 'phonenumber' field in a POST request to the /private/continue-upload.php endpoint. By exploiting this weakness, an attacker can read, modify, or delete any data in the underlying database, thereby compromising data integrity, confidentiality, and potentially availability. The weakness is a classic CWE‑89 injection flaw.

The affected product is Zeon Academy Pro from Zeon Global Tech. No specific affected versions are listed, so all releases of the product are potentially vulnerable until a patch is released.

With a CVSS score of 9.3 the vulnerability is considered critical. The EPSS score is not available, but the lack of a known patch and the high severity suggest that exploitation is plausible and could be performed remotely via HTTP POST. The vulnerability is not listed in the CISA KEV catalog, but that does not reduce the risk to the user. The likely attack vector is through a web request to the exposed endpoint, meaning that anyone with network access to the application can initiate the exploit.