CVE-2024-35563 is a critical SQL injection vulnerability affecting CDG-Server versions up to and including 5.6.2.126.139. The flaw exists in the permissionId parameter of the CDGTempPermissions component, allowing remote attackers to inject malicious SQL queries without any authentication or user interaction. This can lead to complete compromise of the affected system's data confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.8, reflecting its high impact and ease of exploitation. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can result in unauthorized disclosure, modification, or deletion of data within the affected CDG-Server. It can also lead to denial of service or full system compromise due to the high severity of the SQL injection flaw. The vulnerability requires no privileges and no user interaction, increasing the risk of widespread exploitation if left unmitigated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected CDG-Server instances to trusted networks only and monitor for unusual database activity related to the permissionId parameter. Avoid exposing the vulnerable service directly to untrusted networks.