The vulnerability occurs when a value taken from the request body is concatenated directly into a T‑SQL statement without parameterization or escaping. This flaw lets a remote attacker inject arbitrary SQL commands that execute with the privileges of the application’s database account, permitting full read, write, delete, and potentially disruptive operations against the database. The impact includes severe compromise of confidentiality, integrity, and availability of the data stored by JTL‑WMS.

The issue is reported for the JTL‑WMS product from JTL SW GmbH. No specific affected versions are disclosed in the advisory, so all current and future releases of this product should be examined for the vulnerability.

The CVSS score of 9.4 indicates critical severity, while the EPSS score of less than 1 % suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a remote web request, so an unauthenticated or lightly authenticated attacker can trigger the injection. Successful exploitation would enable arbitrary SQL execution in the context of the application’s database account, leading to significant data loss or service disruption.