This vulnerability (CVE-2024-51579) in Saleswonder Team's 5 Stars Rating Funnel (<= 1.4.01) is due to improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. The CVSS 3.1 score is 8.5, indicating high severity, with an attack vector of network, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (scope: changed), with high confidentiality impact and low availability impact, but no integrity impact. No patch or remediation information is currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute crafted SQL commands that may expose sensitive data (high confidentiality impact) and cause limited denial of service (low availability impact). Integrity is not impacted. The vulnerability requires low privileges and no user interaction, making it relatively easier to exploit remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider restricting access to the vulnerable component and monitor for suspicious activity related to SQL injection attempts.