CVE-2024-34334 identifies a SQL injection vulnerability (CWE-89) in the forgot password function of ORDAT FOSS-Online before version 2.24.01. The vulnerability allows unauthenticated remote attackers to inject SQL commands, which can compromise the confidentiality of the system's data. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and high confidentiality impact but no integrity impact and low availability impact. No known exploits in the wild or vendor patch information are currently available.

Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database, severely impacting confidentiality. The vulnerability does not affect data integrity but may cause limited availability issues. The critical CVSS score indicates a high risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the forgot password function if possible and monitor for suspicious activity related to SQL injection attempts targeting this functionality.