The vulnerability resides in the include/session.inc.php file of Devome GRR v4.5.0 and allows an authenticated user to inject arbitrary SQL statements through forged Referer and User-Agent headers. The flaw can lead to unauthorized data exposure or modification, compromising the confidentiality and integrity of the audit database.

Devome GRR version 4.5.0 is affected. No additional vendors or product versions are specified.

The CVSS score of 8.8 indicates high severity, while the EPSS score under 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need valid credentials to submit malicious headers, implying the threat is primarily internal or from compromised accounts. Successful exploitation could allow an attacker to query, tamper with, or delete audit records.