The vulnerability is an SQL injection flaw in the Drupal amazee.ai Private AI Provider module, where unsanitized user input can be incorporated into database queries. If exploited, an attacker could execute arbitrary SQL commands, potentially reading, modifying, or deleting data in the application’s database. This breach of confidentiality, integrity, and possibly availability makes the vulnerability a high‑risk issue for any system that relies on the affected module.

Drupal’s amazee.ai Private AI Provider is affected in all releases from 0.0.0 to 1.3.7 and from 1.4.0 to 1.4.3. The vendor product is the amaze.ai Private AI Provider module for Drupal.

The issue permits remote exploitation through any web interface that accepts input used in database queries; the likely attack vector is via user‑supplied input sent to the module, inferred from the description. With a CVSS score of 6.5, the vulnerability is classified as a moderate‑severity flaw, and its EPSS score of less than 1% suggests a low probability of exploitation. Although the vulnerability is not listed in the CISA KEV catalog and no evidence of active exploitation exists, the nature of the flaw and absence of defensive controls indicate a serious risk to any installation that has not applied an update beyond the identified affected versions.