CVE-2024-46532 is a critical SQL Injection vulnerability affecting OpenHIS version 1.0. The issue exists in the refund function within the PayController.class.php file, enabling remote attackers to execute arbitrary code without authentication. This vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 9.8, reflecting its critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary code on the affected system, leading to full compromise of the application, unauthorized data access, modification, or deletion, and potential disruption of service. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, it is recommended to restrict access to the affected functionality, apply web application firewalls with SQL injection detection rules, and monitor for suspicious activity related to the refund function. Avoid exposing the vulnerable component to untrusted networks.