Mautic’s Lead-by-Field-Value AJAX endpoint accepts a "field" parameter from the request and sanitizes it only with InputHelper::clean, which merely HTML‑entity‑encodes quotes and angle brackets but does not restrict other characters. The cleaned value is then concatenated directly as a raw SQL column identifier in LeadRepository::buildQueryForGetLeadsByFieldValue, without being validated against a whitelist or bound as a parameter. This flaw, classified as CWE‑89, allows an attacker to inject arbitrary SQL by specifying a field name containing SQL syntax, potentially enabling them to read or modify sensitive database contents and undermining confidentiality and integrity. Based on the description, it is inferred that attackers must be authenticated to reach the vulnerable endpoint.

The vulnerability affects all Mautic installations that include the vulnerable getLeadIdsByFieldValueAction. No specific product version range is listed, so any released version that contains the flaw is potentially impacted.

The CVSS score of 7.1 indicates a high severity for authenticated attackers, while the EPSS score is < 1 %, indicating a very low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed public exploit yet. Based on the description, it is inferred that the likely attack vector is remote access to the AJAX endpoint from an authenticated session after logging in, allowing the attacker to manipulate the database through injected SQL.