The vulnerability CVE-2024-49655 affects reputeinfosystems ARPrice (up to version 4.1.3) and is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. This allows remote attackers to execute arbitrary SQL queries without authentication. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and high confidentiality impact but no integrity impact and low availability impact. No patch or official remediation information is currently available.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). The vulnerability affects all users of ARPrice up to version 4.1.3. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable application and monitor for unusual database activity. Avoid exposing ARPrice installations to untrusted networks if possible.