This vulnerability (CVE-2024-43282) in Themeum Tutor LMS versions up to 2.7.2 is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). It allows an attacker with high privileges to inject SQL commands due to insufficient input sanitization, potentially leading to partial denial of service and confidentiality impact. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and scope change. No patch or remediation level has been published by the vendor yet.

The vulnerability could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to partial denial of service and disclosure of confidential information. However, exploitation requires high privileges, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege access to the Tutor LMS application and monitor for unusual activity related to SQL queries. Follow updates from Themeum for official patches or mitigations.