The vulnerability CVE-2025-24672 affects codepeople Form Builder CP versions up to 1.2.41 and is classified as an SQL Injection due to improper neutralization of special elements in SQL commands. An attacker with network access and low privileges can exploit this to execute unauthorized SQL queries. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality loss and low availability impact, with no integrity loss. No official patch or remediation information is currently available.

Successful exploitation allows an attacker to execute unauthorized SQL commands on the affected system, potentially exposing sensitive data (confidentiality impact) and causing limited disruption to service availability. There is no indication of integrity compromise. The vulnerability requires low privileges and no user interaction, making it a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable Form Builder CP instance to untrusted networks.