This vulnerability (CVE-2024-30242) in IT Path Solutions 'Contact Form to Any API' is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands (SQL Injection). It affects versions up to 1.1.8 and allows an attacker with network access and low privileges to execute crafted SQL commands that could compromise confidentiality and cause limited availability impact. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, no user interaction, and scope change. No official patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity impact is not indicated. The vulnerability can be exploited remotely over the network by an attacker with low privileges without requiring user interaction. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor for vendor updates and consider restricting access to the affected component where possible until a patch is available.