The vulnerability CVE-2024-54261 affects the TAX SERVICE Electronic HDM software by HK Digital Agency LLC. It is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. This allows remote attackers to execute arbitrary SQL code without authentication, potentially compromising the entire database and system. The affected versions are up to 1.2.2. The vulnerability has a critical CVSS 3.1 base score of 10.0, reflecting its high impact and ease of exploitation. No official patch or vendor advisory has been provided yet.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider applying any available workarounds or mitigating controls such as input validation or web application firewalls specifically tuned to detect SQL injection attempts. Monitor vendor channels for updates and apply patches promptly once available.