The vulnerability is a classic SQL injection flaw (CWE‑89) that permits unauthenticated remote attackers to supply arbitrary SQL statements. By exploiting this flaw, an attacker can read database contents, effectively exposing sensitive information. The vulnerability resides in the C&Cm@il component of the HGiga package.

HGiga’s C&Cm@il package, distributed as olln-base, is affected. Any installation using versions older than 7.0‑978 is vulnerable; versions 7.0‑978 or later contain the vendor‑provided fix.

The CVSS score of 8.7 indicates a high‑severity risk, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The flaw is exploitable remotely without authentication, requiring only that an attacker be able to send crafted input to the vulnerable endpoint. Although a successful attack would compromise the confidentiality of database contents, there is no evidence of further consequences such as code execution or privilege escalation in the current description. The vulnerability is not listed in the CISA KEV catalog at this time.