This vulnerability (CVE-2024-7837) in Firmanet Software ERP is categorized as CWE-89, indicating improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. It allows unauthenticated remote attackers to inject malicious SQL statements due to insufficient input validation or sanitization. The affected product versions include all releases up to 22.11.2024. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with limited integrity impact and no availability impact. The vendor has not provided any patch or mitigation details, and the vulnerability remains unaddressed.

Successful exploitation could allow remote attackers to access or disclose sensitive database information, compromising confidentiality. The integrity impact is limited, and availability is not affected. There are no known active exploits reported. The lack of vendor response and absence of patches means the vulnerability remains a significant risk for affected Firmanet ERP deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should consider implementing compensating controls such as input validation, web application firewalls, or restricting database permissions as interim measures. Monitor for any updates from the vendor regarding patches or official mitigations.