The vulnerability is a classic SQL injection flaw in the GET /admin/User/getUsers endpoint of ApiAdmin where the gid parameter is accepted without proper sanitization. An attacker able to send a crafted HTTP GET request can inject arbitrary SQL fragments into the backend database query, potentially reading, modifying, or deleting application data. If the database account used by the application has elevated privileges, the attacker could gain access to sensitive system information, thereby compromising the confidentiality and integrity of the stored data.

ApiAdmin version 5.0 and earlier are affected. The vendor is unspecified; the vulnerability exists in the user‑list endpoint of the administrative interface. Users running any or legacy releases of ApiAdmin should assume they are susceptible until a patch is applied.

The EPSS score of 0.00153 indicates a low estimated likelihood of exploitation, although it does not preclude actual attack activity. This vulnerability is not listed in the CISA KEV catalog, which suggests limited documented exploitation so far. Based on the description, the likely attack vector involves a remote, authenticated request to the administrative API, which is usually restricted to privileged users. Consequently, an attacker capable of spoofing or legitimizing such a request could achieve arbitrary data modification or disclosure, matching a high‑severity data compromise risk.