This vulnerability (CVE-2024-2865) in Mergen Software Quality Management System is caused by improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). It allows remote attackers to execute arbitrary SQL code without authentication (AV:N/AC:L/PR:N/UI:N), potentially leading to full compromise of the affected system's database confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, reflecting critical severity. The affected product is not a cloud service, and no patch or vendor remediation information is currently provided.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, data modification, or denial of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level. No known exploits are reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended workarounds from the vendor or restrict access to the affected system to trusted users only. Monitor vendor channels for updates and patches addressing this vulnerability.