This vulnerability (CVE-2024-8259) is an instance of CWE-89, where the NatraCar B2B Dealer Management Program fails to properly sanitize input used in SQL commands, leading to SQL Injection. This allows remote attackers to execute arbitrary SQL code without authentication, potentially compromising the database and system. The affected product is not cloud-based and is no longer supported by the vendor, meaning no official fix or patch exists. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the underlying database, including unauthorized data disclosure, data modification, and potential denial of service. Given the critical CVSS score of 9.8, the impact is severe, affecting confidentiality, integrity, and availability of the system. Since the product is unsupported, organizations using it remain exposed without vendor-provided remediation.

No official patch or remediation is available as the vendor no longer supports the product. Organizations should consider mitigating risk by isolating the affected system, restricting network access, employing web application firewalls with SQL Injection detection capabilities, or migrating to a supported alternative product. Continuous monitoring for suspicious database activity is recommended. Patch status is not yet confirmed due to lack of vendor support; check for any community or third-party mitigations.