L-ONE v1.0.0 contains SQL injection flaws in the /attachment/getBusinessUploadList component, allowing attackers to inject crafted SQL via the busid, id, and taskid parameters. The vulnerability can lead to legitimate database queries being manipulated to expose confidential information, resulting in confidentiality compromise and potential data leakage. The impact is that attackers can retrieve or manipulate sensitive data without authorization

The affected system is the L-ONE application version 1.0.0, which does not specify a vendor in the CNA data. Users of this version who expose the /attachment/getBusinessUploadList endpoint to the network are at risk

The CVSS score is not available in the provided data and the EPSS score is also unavailable, making precise numeric risk assessment impossible; however, any active SQL injection vector typically carries a high exploitation likelihood if the endpoint is reachable. The vulnerability is inferred to be exploitable remotely via HTTP requests to the vulnerable endpoint. There is no indication that this flaw is currently listed in CISA's KEV catalog, and no known public exploit has been reported, but the absence of mitigations defaults to a high potential for exploitation.