This vulnerability (CVE-2024-10244) in ISDO Software Web Software arises from improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). It affects versions prior to 3.6 and allows remote attackers to execute arbitrary SQL commands without authentication, potentially leading to full compromise of the affected system's database. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, data modification, or complete system compromise. The high CVSS score (9.8) indicates critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls or other SQL injection mitigations specific to their environment. Monitor vendor channels for updates and apply patches promptly once available.