The a+HRD application developed by aEnrich contains a SQL Injection flaw that allows authenticated remote attackers to inject arbitrary SQL commands, enabling the extraction of database contents. This vulnerability compromises the confidentiality of sensitive data stored by the application. Although the attack requires prior authentication, the attacker can potentially read, modify, or delete information, thereby exposing business logic secrets and customer data.

All installations of a+HRD by aEnrich are vulnerable; the advisory recommends upgrading to version 6.8 or later and applying the latest patches. No specific version range is listed beyond that requirement, so unsupported or older deployments remain at risk.

The CVSS score of 7.1 classifies this issue as high severity. Because the vulnerability is only exploitable by authenticated users, the exploitation likelihood depends on the attacker’s ability to gain valid credentials. No EPSS score is available and the vulnerability is not currently listed in the CISA KEV catalog, indicating no known widespread exploitation at this time. The primary attack vector is an authenticated remote request to the application that submits malicious SQL payloads.