CVE-2024-25910 describes an SQL Injection vulnerability (CWE-89) in Skymoonlabs MoveTo versions up to 6.2. The issue arises from improper neutralization of special elements in SQL commands, enabling an unauthenticated attacker to execute arbitrary SQL code remotely over the network. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to full compromise of the affected system's data confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor for vendor updates and consider implementing application-layer protections such as input validation or web application firewalls as interim measures.