This issue involves a classic SQL injection vulnerability (CWE-89) that is triggered when performing raster lookups on Django's RasterField using PostGIS. The band index parameter is not properly sanitized, allowing an attacker to inject arbitrary SQL statements via the query path. If exploited, the attacker could read, modify, or delete database data, potentially compromising information confidentiality and integrity.

The Django applies to releases before 6.0.2 in the 6.0 series, before 5.2.11 in the 5.2 series, and before 4.2.28 in the 4.2 series; unsupported older series such as 5.0.x, 4.1.x, and formally evaluated but may share the same code and require patching.

The CVSS score of 5.4 indicates a medium severity, and the EPSS score of 9% indicates a moderate likelihood of exploitation. The attack vector is remote and requires the ability to send crafted requests to Django applications that use PostGIS raster lookups. Because the vulnerability is not listed in the CISA evidence of widespread exploitation yet, but the potential impact justifies swift action.