This vulnerability (CVE-2024-30236) involves improper neutralization of special elements used in SQL commands within Contest Gallery software, allowing SQL Injection attacks. The issue affects versions through 21.3.4. The CVSS 3.1 score is 8.5, indicating high severity, with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (scope: changed), with high confidentiality impact and low availability impact, but no integrity impact. No patch or vendor advisory is currently provided, and no known exploits have been reported.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction. The impact includes potential unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted. The scope of the vulnerability is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected software to trusted users only and monitor for unusual activity. Avoid exposing the vulnerable version of Contest Gallery to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.