This vulnerability (CVE-2024-12918) involves improper neutralization of special elements used in SQL commands (CWE-89) within the Health4All product by Agito Computer. It allows an attacker with at least low privileges and no user interaction to perform SQL Injection attacks, potentially leading to full confidentiality, integrity, and availability compromise of the affected system. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The issue affects versions prior to 10.01.2025. No patch or official remediation level has been published yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, leading to unauthorized data disclosure, data modification, or denial of service. The impact includes full compromise of confidentiality, integrity, and availability of the affected system's data. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected system to trusted users only and monitor for unusual database activity. Avoid exposing the vulnerable interface to untrusted networks. Follow vendor updates closely for patch releases.