This vulnerability (CVE-2024-12016) in CM Informatics CM News is classified as CWE-89 (SQL Injection). It arises from improper neutralization of special elements used in SQL commands, allowing an attacker to inject malicious SQL code. The issue affects CM News versions through 6.0. The vendor has confirmed that the product is no longer supported, and no patch or official remediation is available. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's database, including unauthorized data disclosure, data modification, and potential denial of service. Given the critical CVSS score, the impact is severe. However, no known exploits have been reported in the wild so far.

Since the vendor no longer supports CM News and no official patch or remediation is available, users should consider discontinuing use of the affected product or isolating it from untrusted networks. Employing web application firewalls (WAFs) with SQL injection detection and prevention rules may provide some mitigation. Careful input validation and migration to supported software versions or alternative products are recommended.