Improper neutralization of special elements used in an SQL command allows an attacker to inject arbitrary SQL statements against the database. The vulnerable code accepts unvalidated input and incorporates it directly into a database query. By exploiting this weakness, an attacker could potentially read, modify, or delete data stored in the database, thereby compromising the confidentiality, integrity, or availability of that data. This flaw is a classic SQL Injection (CWE‑89).

The Drupal Location Selector module is affected. All versions from 0.0.0 through 1.3.0 are vulnerable. Operators running Drupal sites that use any of these versions should verify whether the module is installed and plan a remediation strategy.

The vulnerability is triggered via the web interface that accepts location selector input, which is the likely attack vector. No publicly reported exploit is known, and the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The CVSS score of 7.4 demonstrates a high potential impact on confidentiality and integrity. The issue is not listed in the CISA KEV catalog, suggesting lower public exploitation risk.