This vulnerability (CVE-2024-37564) in PayPlus Payment Gateway arises from improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). It affects versions up to 7.0.7. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and requires low privileges but no user interaction. The impact includes a high confidentiality loss and low availability impact, with no integrity impact. No official remediation level or patch information is currently provided by the vendor, and the product is not a cloud service.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to partial disclosure of sensitive information and minor disruption of service availability. There is no indication of integrity compromise. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider applying compensating controls such as input validation and restricting database permissions where possible. Monitor vendor communications for updates on official patches or mitigations.