The vulnerability allows an attacker to inject arbitrary SQL by manipulating the PGUID parameter in the AsyncTreeProxy.aspx component. This flaw combines issues with missing input validation (CWE-74) and lack of proper parameterization (CWE-89). An attacker who successfully exploits the flaw can retrieve, modify, or delete data stored in the underlying database, potentially leading to privacy breaches or corruption of critical operational data.

Sciyon Koyuan Thermoelectricity Heat Network Management System version 3.0 contains the affected file path /SISReport/WebReport20/Proxy/AsyncTreeProxy.aspx. No additional sub-component or patch level details are documented, and the vendor has not released an official fix according to the available information.

The CVSS base score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker could likely launch the attack remotely via the web interface, provided the target system is exposed to the public or an untrusted internal network.