GestSup versions prior to 3.2.60 contain a SQL injection flaw in the ticket creation feature. The flaw allows an attacker who is already authenticated to supply crafted input that is inserted into database queries without proper sanitization. If leveraged, an attacker can read, alter, or delete records in the application database, potentially exposing sensitive information or corrupting business data.

GestSup's ticket management application, any deployment running a version earlier than 3.2.60.

The CVSS score of 7.7 indicates a high rating. EPSS suggests a low probability of exploitation in the general population, but the vulnerability can only be exploited with valid user credentials, implying the attack vector is controlled and local to the application. Because the weakness is an unchecked concatenation of user input into SQL statements (CWE‑89), only users with sufficient permissions to create tickets can launch the attack. Even with these conditions, the potential impact on confidentiality, integrity, and availability is significant. The vulnerability is not currently listed in CISA KEV, which means no evidence of known exploitation has been reported, yet the possibility of a targeted exploit remains.