This vulnerability (CVE-2024-12144) affects Finder Fire Safety Finder ERP/CRM (Old System) versions prior to 18.12.2024. It is caused by improper neutralization of special elements used in SQL commands, leading to SQL Injection (CWE-89). The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor has not yet provided an official fix or remediation level. The product is not a cloud service, so remediation depends on vendor patching the on-premises software.

Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This can result in unauthorized data disclosure, data modification, or complete system compromise. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability of the affected system. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should limit exposure by restricting network access to the affected system and monitor for suspicious activity. Apply vendor patches promptly once released.