The vulnerability lies in the ezform.php script of the damasac Thai Palliative LTE application, where the idFormMain and id parameters are concatenated directly into SQL queries without any sanitization or use of parameterized statements. An attacker who can construct HTTP requests to /substudy/ezform.php can inject arbitrary SQL commands, potentially causing data disclosure, modification, or deletion. This is an injection flaw classified as CWE‑89.

Any instance of damasac Thai Palliative LTE version 3.0 that hosts the ezform.php endpoint is susceptible. The vulnerability is triggered by remote HTTP requests carrying crafted values in the idFormMain or id parameters, so any machine exposed to the web interface of this application is at risk.

With a CVSS score of 9.8 the issue is extremely severe, and the absence of an EPSS value suggests the estimation of exploitation probability is not available, yet the flaw remains exploitable over the network. The vulnerability is not currently listed in the CISA KEV catalog, but its high severity and remote nature imply it could be actively targeted. Attackers can exploit the flaw from any remote location, bypassing authentication by simply sending malicious parameters, with potential to compromise the underlying database.