CVE-2024-51843 describes an improper neutralization of special elements used in an SQL command (SQL Injection) vulnerability affecting the Horsemanager product by fruitcakestudios, up to version 1.3. This vulnerability enables blind SQL injection attacks, allowing an attacker with low privileges and no user interaction to cause a confidentiality breach with limited impact on availability. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation guidance is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database (high confidentiality impact) without requiring user interaction. The integrity impact is none, and availability impact is low, indicating limited disruption to service. The vulnerability requires low privileges but can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected application to trusted users only and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting Horsemanager. Monitor for updates from fruitcakestudios regarding an official fix.