Bit Apps Bit Form up to version 2.13.11 contains an SQL Injection vulnerability (CVE-2024-47335) caused by improper neutralization of special elements in SQL commands. This allows an attacker with high privileges to execute arbitrary SQL queries, potentially compromising confidentiality and causing partial denial of service. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and impact on confidentiality and availability but not integrity. No patch or vendor advisory information is currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive data (confidentiality impact) and partial denial of service (availability impact). Integrity is not affected. The attacker must have high privileges to exploit this vulnerability, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict high-privilege access to the affected Bit Form instances and monitor for unusual database activity. Avoid exposing the application to untrusted networks where possible.