This vulnerability (CVE-2024-12364) affects Mavi Yeşil Software's Guest Tracking Software and involves improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to full compromise of the affected system's data confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on all security properties. The vendor has not disclosed any patch or remediation status, and no exploits are currently known in the wild.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the Guest Tracking Software database without authentication. This can lead to unauthorized data disclosure, modification, or deletion, and potentially full system compromise. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not provided information about a fix or mitigation, organizations should monitor official channels for updates. Until a patch is available, consider restricting network access to the affected software and applying compensating controls such as web application firewalls to detect and block SQL injection attempts.