The vulnerability CVE-2024-54361 affects tenteeglobal Instant Appointment (<= 1.2) and is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. This allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially compromising confidentiality and causing limited availability impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation details are currently available.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, leading to high confidentiality impact such as unauthorized data disclosure. Integrity impact is not indicated, and availability impact is low. The vulnerability is exploitable without authentication or user interaction, increasing risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected application and monitor for unusual database activity. Avoid exposing the vulnerable service to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.