← Zuruck zu CVEs

CVE-2024-13979

CRITICAL

9.8

Beschreibung

A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht8/27/2025

Zuletzt geandert9/9/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

st._joe_erp_system_project:st._joe_erp_system

Schwachen (CWE)

CWE-89

Referenzen

https://blog.csdn.net/qq_41904294/article/details/144240396(disclosure@vulncheck.com)

https://en.fofa.info/result?qbase64=5Zyj5LmURVJQ57O757uf(disclosure@vulncheck.com)

https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/st-joes-erp-system-sqli(disclosure@vulncheck.com)

https://blog.csdn.net/qq_41904294/article/details/144240396(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.vulncheck.com/advisories/st-joes-erp-system-sqli(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.