CVE-2025-24665 describes an SQL Injection vulnerability in enituretechnology's Small Package Quotes – Unishippers Edition (versions up to 2.4.8). The vulnerability arises from improper neutralization of special elements in SQL commands, allowing unauthenticated remote attackers to inject SQL code. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, no integrity impact, and low availability impact. No known exploits or patches are reported in the provided data.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to disclosure of sensitive information (high confidentiality impact). Integrity is not impacted, and availability impact is low. The vulnerability affects all versions up to and including 2.4.8 of the product. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected application and applying web application firewall rules to detect and block SQL injection attempts if possible.