The vulnerability is a classic SQL injection flaw that occurs when input provided in the "profilInput" parameter is not properly neutralized. This flaw allows an attacker to inject arbitrary SQL statements into the underlying database queries, potentially enabling them to read, modify, or delete sensitive data. The impact is confined to the scope of database content; however, the high CVSS score of 8.4 indicates that the database can serve as a gateway to broader system compromise if the application is part of a larger stack.

ARKETEAM Protectel modules PROTECTELMAJ and BDF are affected. Users running PROTECTELMAJ versions earlier than 6.5.19 or BDF versions earlier than 6.4.67 are susceptible to the vulnerability. These modules are commonly deployed in web and management interfaces of industrial and security applications.

The vulnerability is scored at CVSS 8.4 and currently has no EPSS score available, indicating uncertainty about its exploitation frequency. It is not listed in the CISA KEV catalog, suggesting no widely known active exploitation. The likely attack vector is internal or web-based, as the flaw is triggered by a low privileged authenticated user supplying the "profilInput" value. Attackers would need valid credentials to access the vulnerable endpoint and could then execute arbitrary SQL commands to exfiltrate data or modify database state.