This vulnerability (CVE-2024-37256) affects Themeum Tutor LMS through version 2.7.1 and is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands (SQL Injection). The CVSS 3.1 base score is 7.6, reflecting a high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change. The impact is primarily on confidentiality (high) and availability (low), with no integrity impact noted. No patch or official remediation level has been provided by the vendor as of the publication date.

An attacker with high privileges could exploit this SQL Injection vulnerability to access or disclose sensitive database information, potentially compromising confidentiality. The vulnerability does not impact data integrity but may cause limited availability issues. Since exploitation requires high privileges, the risk is somewhat mitigated by the need for elevated access. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict high-privilege access to the Tutor LMS application and monitor for unusual database activity. Avoid exposing the application to untrusted networks or users with elevated privileges. Follow vendor updates closely for any forthcoming patches or mitigations.