CVE-2024-38885 describes a security flaw in Caterease software from Horizon Business Services Inc., affecting versions 16.0.1.1663 through 24.0.1.2405 and possibly later. The client application contains hardcoded SQL user credentials, which can be exploited by remote attackers to perform unauthorized access without requiring privileges or user interaction. This vulnerability is classified under CWE-259 (Use of Hard-coded Password). No official patch or remediation information is currently provided.

Exploitation of this vulnerability allows remote attackers to gain unauthorized access to the affected Caterease application by using embedded SQL credentials. This can lead to unauthorized data access with high confidentiality impact, though integrity and availability impacts are not indicated. The vulnerability does not require user interaction or privileges, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Caterease client application and monitor for unauthorized access attempts. Avoid exposing the application to untrusted networks. Follow vendor updates closely for any released patches or official mitigations.