GestSup versions older than 3.2.60 contain multiple SQL injection flaws in the asset list feature. Filter, search, and sort request parameters are directly inserted into SQL statements without adequate sanitization, enabling a logged‑in attacker to craft malicious inputs. By exploiting these flaws the attacker can read sensitive information or alter database records, depending on the privileges granted to the database user.

The vulnerability affects the GestSup application, specifically all releases before 3.2.60. The exposed functionality is the asset list page, which any authenticated user can access.

The CVSS score of 7.5 indicates a high severity, while the low EPSS value (<1%) suggests that exploitation is currently unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog, meaning no widespread exploit has been reported. Authentication is required, so only users with valid credentials on the system can abuse the injection points. If the application’s database user has read or write privileges, the impact could range from data leakage to full data tampering. The absence of current public exploitation reduces immediate threat, but the high potential damage warrants prompt remediation.