This vulnerability (CVE-2024-31355) in Tribulant Slideshow Gallery arises from improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). It affects all versions up to 1.7.8. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts including high confidentiality loss and low availability impact. The vulnerability allows an attacker with low privileges to inject SQL commands that could compromise data confidentiality and partially affect availability. No official patch or remediation level has been published by the vendor, and no exploits are currently known in the wild.

Successful exploitation could lead to unauthorized disclosure of sensitive data due to SQL Injection. The confidentiality impact is high, while integrity impact is not indicated, and availability impact is low. Attackers require low privileges and no user interaction to exploit this vulnerability remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin and monitor for updates from Tribulant. No official remediation or temporary fix is currently available.