This vulnerability, identified as CVE-2024-22283, affects Delhivery Logistics Courier up to version 1.0.107. It is classified as CWE-89, indicating improper neutralization of special elements in SQL commands, commonly known as SQL Injection. The CVSS 3.1 base score is 8.5 (high), with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (S:C), with high confidentiality impact, no integrity impact, and low availability impact. No patch or official fix has been documented, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. There are no known active exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor for vendor updates. Until a fix is available, consider restricting access to the affected application to trusted users and networks as a temporary measure.