This vulnerability (CVE-2024-38773) affects Adrian Tobey FormLift for Infusionsoft Web Forms versions up to 7.5.17. It is caused by improper neutralization of special elements used in SQL commands, resulting in a Blind SQL Injection flaw (CWE-89). The flaw allows unauthenticated remote attackers to inject SQL commands, potentially leading to unauthorized disclosure of sensitive information. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation is currently documented.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive data from the backend database due to Blind SQL Injection. The vulnerability does not impact data integrity but can cause partial denial of service. The critical CVSS score indicates a severe risk if exploited. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected FormLift for Infusionsoft Web Forms versions or applying web application firewall (WAF) rules to detect and block SQL injection attempts. Monitor vendor channels for updates regarding patches or official mitigations.