This vulnerability (CVE-2024-54258) in Ni CRM Lead (<= 1.3.0) is due to improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 score is 8.5 (high), with an attack vector over the network, low attack complexity, requiring low privileges and no user interaction. The impact includes high confidentiality compromise and low availability impact, with no integrity impact. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to extract sensitive information from the database (high confidentiality impact) and cause a limited denial of service (low availability impact). Integrity of data is not impacted. The vulnerability requires network access and low privileges but no user interaction, making it a significant risk if the affected version is in use.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid using affected versions (<= 1.3.0) in production environments if possible.