A high-severity SQL injection vulnerability in YayCommerce YaySMTP could allow an authenticated attacker with high privileges to compromise database information.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89), specifically within the smtp-sendinblue functionality. The CVSS vector (PR:H) indicates that successful exploitation requires an attacker to possess high privileges within the application.

The ability to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. An attacker could potentially extract sensitive information from the database or disrupt service availability. With a CVSS score of 7.6, this flaw represents a high risk that requires prioritized attention to prevent unauthorized database access.

Immediate Action: Since no specific patch version is currently identified, administrators should monitor the official YayCommerce support channels and the Patchstack database for release updates and apply them immediately upon availability.

Proactive Monitoring: Review database audit logs for anomalous or unauthorized SQL queries, particularly those originating from the smtp-sendinblue module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns.

Public Exploit Available: No

Given the severity of this SQL injection vulnerability, administrators should treat this as a priority item. While high privileges are required for exploitation, the potential for database compromise necessitates strict enforcement of the principle of least privilege and immediate application of patches once they are released by the vendor.