The vulnerability CVE-2024-55973 affects rnystrom TSB Occasion Editor (<= 1.2.1) and is caused by improper neutralization of special elements in SQL commands, resulting in an SQL Injection flaw. This allows an attacker with network access and low privileges to execute unauthorized SQL queries without user interaction. The CVSS 3.1 base score is 8.5, reflecting high confidentiality impact, no integrity impact, and low availability impact. The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation details. The product is not a cloud service, so remediation depends on vendor updates or user-applied fixes.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and minor disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. The vulnerability requires low privileges and no user interaction, increasing the risk if the attacker has network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor for vendor updates. Applying any available security updates from rnystrom promptly is recommended once released. Until then, restricting network access to the affected application and applying compensating controls may reduce risk.