This vulnerability (CVE-2024-55975) in Rohit Urane's Dr Affiliate product allows SQL Injection due to improper neutralization of special elements in SQL commands. It affects versions up to 1.2.3. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, with a scope change and high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with low privileges to perform SQL injection attacks remotely without user interaction, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited denial of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. The scope change indicates that the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider restricting access to the affected application and monitor for unusual database activity. Avoid exposing the vulnerable application to untrusted networks if possible.