The vulnerability resides in an undocumented function of iomad’s Company Admin Block. Malicious input that is not properly sanitized can be used to inject arbitrary SQL statements, allowing an attacker to read, modify or delete data from the database. The flaw is a classic example of an Insecure Direct Object Reference problem (CWE‑74) compounded by a traditional SQL injection (CWE‑89), which can compromise the confidentiality and integrity of the application data.

The flaw is present in iomad releases up to and including version 5.0. All customers using these versions, regardless of their deployment size or operating system, are potentially exposed when the affected component is reachable from the network. No specific operating system or platform information is supplied, so the risk applies to any environment running a vulnerable instance of iomad.

The CVSS score of 5.1 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote; an attacker must connect to the system over the network to submit the malicious input. Because no authentication or privilege requirements are explicitly stated in the CVE data, the exploit is assumed to be possible against any user who can access the vulnerable functionality.