The vulnerability CVE-2024-49620 in the FERMA.ru.net product by mrcheck116 is an SQL Injection issue where special elements in SQL commands are not properly neutralized. This allows an attacker with low privileges to perform Blind SQL Injection attacks remotely without user interaction. The affected versions are up to 1.3.3. The CVSS v3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and partial scope change. The impact is high on confidentiality, no impact on integrity, and low impact on availability.

Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database due to Blind SQL Injection. The confidentiality of data is highly impacted, while integrity remains unaffected and availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates and apply any official fixes once released. Until then, restrict access to the affected application and consider additional protective measures such as web application firewalls that can detect and block SQL Injection attempts.