This vulnerability (CVE-2024-32125) in Booking Algorithms BA Book Everything arises from improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). It affects versions up to 1.6.4 and allows an attacker with network access and low privileges to execute crafted SQL commands that can partially disrupt service and compromise data confidentiality. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, no user interaction, and partial impact on confidentiality and availability. No official remediation or patch is currently documented, and the product is not a cloud service.

Successful exploitation could lead to partial denial of service and high confidentiality impact, meaning sensitive data could be exposed or accessed improperly. Integrity impact is not indicated, and availability impact is low. The vulnerability requires low privileges and no user interaction, making it relatively accessible to attackers with network access. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor Booking Algorithms' advisories for updates. In the meantime, restricting network access to the affected application and applying general SQL injection protections where possible may reduce risk, but no vendor-endorsed mitigations are available.