The vulnerability is a classic SQL injection flaw in the User.php component of APiAdmin version 5.0.1, categorized as CWE-89. When exploited, a malicious actor can inject arbitrary SQL statements into the database, potentially retrieving or manipulating sensitive information stored by the application. This type of input validation failure permits the attacker to read or alter data that should be protected. Based on the description, it is inferred that the attack vector is remote, leveraging crafted requests to the vulnerable endpoint.

Zhao‑github APiAdmin version 5.0.1 is affected. No other affected versions are listed in the available data.

The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.4 indicates a high severity. However, because the flaw allows remote extraction of sensitive data without authentication, the risk remains high. Attackers would need to access the application over the network and target the User.php endpoint to insert malicious SQL. The lack of known mitigations or patches in the current data further increases the urgency of addressing the issue.