This vulnerability (CVE-2024-0857) involves improper neutralization of special elements used in SQL commands (CWE-89) in FlexWater Corporate Water Management versions before 5.452.0. It enables an attacker to perform SQL Injection attacks, potentially leading to unauthorized data access, data modification, or denial of service. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed by Universal Software Inc. as of the publication date.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the affected system without authentication, potentially leading to full compromise of the database, data leakage, data corruption, or service disruption. The vulnerability affects all unpatched versions prior to 5.452.0 of FlexWater Corporate Water Management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider applying compensating controls such as input validation, web application firewalls, and restricting database permissions to limit potential damage. Monitor vendor channels for updates and apply patches promptly once available.