The vulnerability lies in the SAP NetWeaver Feedback Notifications Service, where user-controlled fields are concatenated directly into SQL queries without validation. An attacker who has authenticated to the application can inject arbitrary SQL, altering the SELECT WHERE clause. Consequently, the attacker may read, modify, or delete data in the underlying database. The description indicates that the flaw does not affect data integrity and has only a low impact on confidentiality and availability.

SAP NetWeaver Feedback Notification service is impacted. No specific version information is supplied, implying that the flaw may exist in all releases covered by SAP Note 3697355 until the patch is applied.

The CVSS score of 6.4 classifies the flaw as moderate risk, yet the EPSS score is below 1%, suggesting that exploitation attempts are unlikely at present. The vulnerability is not listed in the CISA KEV catalog, supporting a lower threat level. Attackers would need authenticated access to the application and must supply crafted input to manipulate SQL queries. Because the flaw is confined to authenticated users, the attack surface is limited, though still significant for internal actors or compromised accounts.