The flaw is an improper neutralization of special elements in an SQL command, allowing an attacker to inject arbitrary SQL statements. An exploited instance could disclose confidential data, modify records, or delete data. The problem is a classic injection weakness classified as CWE-89.

Interuse i-Bos 3.0 is vulnerable. No other product versions are reported affected.

The CVSS score of 5.9 indicates a moderate overall risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, which suggests a lower but still non‑negligible exploitation probability. Likely exploitation requires remote access through the application’s web or API interface, which is inferred from the nature of the vulnerability and common attack patterns against database‑driven systems.