The vulnerability CVE-2024-49615 affects Henrique Rodrigues SafetyForms versions up to 1.0.0. It involves a Cross-Site Request Forgery (CSRF) flaw that allows an attacker to trigger Blind SQL Injection attacks. The CVSS score is 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to perform Blind SQL Injection via CSRF, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted according to the CVSS vector. The vulnerability requires user interaction but no privileges, and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider mitigating CSRF risks by implementing standard CSRF protections such as anti-CSRF tokens and validating user requests. Monitoring official Henrique Rodrigues channels for updates is recommended.