This vulnerability allows an attacker to inject arbitrary SQL statements through the custom model/form import feature of MCMS. The injection can result in unauthorized data disclosure, modification, or deletion of database contents, compromising confidentiality and integrity of the entire system.

The affected products are MCMS versions 6.1.1 through 6.2.1. No vendor information is specified, and the versions span the 6.x series released during the specified timeframe.

Based on the description, it can be inferred that the likely attack vector is an unsecured custom model/form import endpoint that permits arbitrary SQL execution. The EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The CVSS score of 9.8 reflects a critical severity, meaning an attacker who can exploit this flaw could gain unrestricted access to the database, potentially causing complete data loss, corruption, or theft. The lack of a publicly available exploit remains, but the combination of a high CVSS and even a low EPSS suggests that any exposed import function would be a prime target for attackers, especially if sufficient authenticated privileges are available.