CVE-2024-38889 is a remote SQL Injection vulnerability in Horizon Business Services Inc. Caterease software versions 16.0.1.1663 through 24.0.1.2405. The issue arises from improper neutralization of special elements used in SQL commands, enabling an unauthenticated attacker to execute arbitrary SQL code. The CVSS 3.1 base score is 9.6, indicating critical severity with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system. This can lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider applying network-level controls to restrict access to the affected application and monitor for suspicious activity related to SQL injection attempts.