CVE-2024-58301 is a critical SQL injection vulnerability in Purei CMS 1.0. It arises from improper neutralization of special elements in SQL commands (CWE-89), specifically allowing time-based blind SQL injection attacks. Attackers can exploit unfiltered input parameters on endpoints such as getAllParks.php and events-ajax.php to inject crafted SQL payloads, potentially leading to unauthorized data extraction or modification. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

Successful exploitation can lead to unauthorized disclosure, alteration, or destruction of database information managed by Purei CMS 1.0. This compromises the confidentiality and integrity of the affected system's data. Given the critical CVSS score of 9.3, the vulnerability poses a severe risk to affected deployments.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider implementing application-layer input validation or web application firewalls to detect and block SQL injection attempts targeting the vulnerable endpoints.