This vulnerability (CVE-2024-30499) in CRM Perks Forms arises from improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). It affects CRM Perks Forms versions up to 1.1.4 and allows an attacker with low privileges and no user interaction to execute SQL commands that could compromise confidentiality and cause limited availability impact. The CVSS 3.1 vector indicates network attack vector, low attack complexity, and partial privileges required, with high confidentiality impact and low availability impact.

Successful exploitation could lead to unauthorized disclosure of sensitive information from the database due to SQL Injection. The integrity impact is not indicated, but availability impact is low. There are no reports of active exploitation in the wild. The vulnerability could be leveraged by attackers with some level of access to the application to extract confidential data.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, consider restricting access to the affected application components and applying web application firewall (WAF) rules to detect and block SQL Injection attempts if feasible.