This vulnerability (CVE-2024-39653) in E4J s.r.l.'s VikRentCar product is an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. It affects versions through 1.4.0 and allows remote attackers to execute arbitrary SQL commands without authentication or user interaction. The CVSS 3.1 score of 9.3 reflects its critical nature, with network attack vector, low attack complexity, no privileges required, and a significant confidentiality impact. No official patch or remediation has been published, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the VikRentCar backend database. This could lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). The integrity impact is noted as none in the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, consider restricting network access to the VikRentCar application and applying web application firewall (WAF) rules to detect and block SQL injection attempts if feasible.