This vulnerability (CVE-2024-31356) in Solwin Infotech User Activity Log (up to version 1.8) is classified as CWE-89, indicating improper neutralization of special elements in SQL commands, commonly known as SQL Injection. The CVSS 3.1 base score is 7.6, reflecting a network attack vector with low attack complexity but requiring high privileges and no user interaction. The impact scope is changed (scope: changed), with high confidentiality impact and low availability impact. No official patch or remediation level has been provided by the vendor, and no known exploits have been reported.

An attacker with high privileges on the system could exploit this SQL Injection vulnerability to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is reported as none. Since the vulnerability requires high privileges and no user interaction, exploitation is somewhat constrained but still poses a significant risk to data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit access to the affected plugin and monitor for updates from Solwin Infotech. No vendor advisory or official patch is currently available.