This vulnerability (CVE-2024-38708) is an SQL Injection issue in the Barcode Scanner with Inventory & Order Manager software by Dmitry V. It arises from improper neutralization of special elements in SQL commands, enabling an attacker with network access and low privileges to execute crafted SQL commands. The vulnerability affects all versions up to 1.6.1. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, required privileges, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently available.

An attacker with low privileges and network access can exploit this SQL Injection vulnerability to cause a partial denial of service and potentially access sensitive information, impacting the confidentiality of the system. Integrity is not affected, and availability impact is low. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the application to untrusted networks.