This vulnerability (CVE-2024-7837) in Firmanet Software ERP is caused by improper neutralization of special elements used in SQL commands, leading to SQL Injection. It affects versions of the ERP software up to and including 22.11.2024. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality highly, integrity partially, and no availability impact. The vendor was notified early but has not responded or issued a fix. No exploits are currently known in the wild.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected Firmanet ERP database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and partial modification of data (low integrity impact). There is no impact on availability. This could compromise the confidentiality of the ERP system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor for vendor updates. Until a patch is available, consider applying any available workarounds such as input validation or restricting database permissions to limit potential damage.