This vulnerability (CVE-2024-13151) involves improper neutralization of special elements used in SQL commands (SQL Injection) in the Auto Service Software by ESBI Information and Telecommunication Industry and Trade Limited Company. It affects all versions prior to 2025.10.01. The flaw allows remote attackers to execute arbitrary SQL commands without authentication, leading to potential full compromise of the affected system's database. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this SQL Injection vulnerability can lead to unauthorized disclosure, modification, or deletion of data within the affected software's database. It may also allow attackers to execute arbitrary commands on the backend database, potentially compromising the entire system's security. The critical CVSS score reflects the high risk of data breach and system disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor the vendor's communications closely and plan to upgrade to version 2025.10.01 or later once available. Until then, restricting access to the vulnerable application and employing web application firewalls with SQL Injection detection may help reduce risk.