This vulnerability (CVE-2024-25902) in miniorange Malware Scanner arises from improper neutralization of special elements used in SQL commands (CWE-89), commonly known as SQL Injection. It affects versions through 4.7.2. The CVSS 3.1 base score is 7.6, reflecting a network attack vector with low attack complexity but requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No official patch or vendor advisory is currently available, and the product is not a cloud service.

An attacker with high privileges could exploit this SQL Injection vulnerability to access or manipulate sensitive data in the database, leading to a high confidentiality impact. The vulnerability does not affect integrity but may cause limited availability impact. Since exploitation requires high privileges, the risk is somewhat mitigated by the prerequisite access level. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the affected Malware Scanner installations and monitor for unusual database activity. Avoid exposing the application to untrusted networks or users with elevated privileges. Follow vendor communications for updates on patches or official mitigations.