The flaw resides in the PHP Jabbers PHP Poll Script, where user input supplied to the pjAdminPolls.controller.php endpoint is not properly neutralized. This gives an attacker who has authenticated credentials the ability to inject arbitrary SQL statements. The vulnerability falls under CWE‑89, allowing attackers to read, modify, or delete database contents, potentially compromising confidential poll data and user information, and disrupting the availability of the poll feature.

The affected product is PHP Jabbers’ PHP Poll Script. All versions prior to 4.1 are vulnerable. The fix was released in version 4.1, so any deployment using an earlier version or the unpatched code is at risk.

With a CVSS score of 8.6 the flaw is classified as high severity. Although the EPSS score is below 1%, indicating low predicted exploitation likelihood, the dependency on authenticated access means that any user with valid credentials could exploit the vulnerability once the input is sent to the vulnerable endpoint. The vulnerability is not listed in the CISA KEV catalog, but its potential for data exfiltration and disruption warrants immediate attention.