This vulnerability, tracked as CVE-2024-4228, affects Magarsus Consultancy's SSO product versions 1.0 up to but not including 1.1. It is an SQL Injection issue (CWE-89) where special elements in SQL commands are not properly neutralized, leading to potential unauthorized data exposure (CWE-200) and insufficient credential protection (CWE-522). The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor has not published any patch or official remediation level, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, leading to full compromise of sensitive information, including credentials. This can result in unauthorized access, data leakage, and potential disruption of the SSO service. The critical CVSS score reflects the severity of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected SSO system, applying web application firewalls with SQL injection detection rules, and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable version to untrusted networks where possible.