The vulnerability is an SQL injection flaw in Kobikom, enabling an attacker to send crafted SQL statements due to improper neutralization of special elements. This flaw can allow unauthorized read, modification, or deletion of data, potentially compromising the confidentiality, integrity, and availability of the telecommunication system's database. The flaw is classified as CWE-89 (SQL Injection).

The affected product is Kobikom from Kobikom Telecommunications and Informatics Services Inc. All releases prior to KobiPBX-FOP3-SEC-r1 are vulnerable. Users operating versions before this patch should assume the system is at risk.

Based on the description, the likely attack vector is remote via exposed interfaces. The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need remote access to vulnerable input fields, likely through a web or API interface, to exploit this flaw. Once exploited, the attacker could execute arbitrary SQL queries, leading to data exfiltration or modification. The risk remains significant for systems lacking the patch and without adequate input sanitization or database privilege restrictions.