The vulnerability resides in the backup restore command of zuraCast. When an attacker supplies a malicious backup archive, the system extracts the contained db.sql file and executes it against the database without any input validation or sanitization. This allows the attacker to inject arbitrary SQL statements, potentially enabling the execution of commands that elevate their privileges or disclose sensitive data.

All zuraCast installations running version 0.23.7 or earlier are vulnerable, as this version contains the unvalidated restore functionality. No other vendor or product is listed as affected.

The EPSS score is < 1% and the CVSS score is 9.8, indicating a high severity vulnerability that is not listed in the KEV catalog. The ability to run arbitrary SQL commands through a trusted restoration process indicates a high impact if an attacker can reach the restore endpoint. The absence of defensive checks makes exploitation straightforward for an attacker in reach of the restore operation.