← Voltar para CVEs
CVE-2024-13979
CRITICAL9.8
Descricao
A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.
Detalhes CVE
Pontuacao CVSS v3.19.8
SeveridadeCRITICAL
Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vetor de ataqueNETWORK
ComplexidadeLOW
Privilegios necessariosNONE
Interacao do usuarioNONE
Publicado8/27/2025
Ultima modificacao9/9/2025
Fontenvd
Avistamentos honeypot0
Produtos afetados
st._joe_erp_system_project:st._joe_erp_system
Fraquezas (CWE)
CWE-89
Referencias
https://blog.csdn.net/qq_41904294/article/details/144240396(disclosure@vulncheck.com)
https://en.fofa.info/result?qbase64=5Zyj5LmURVJQ57O757uf(disclosure@vulncheck.com)
https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md(disclosure@vulncheck.com)
https://www.vulncheck.com/advisories/st-joes-erp-system-sqli(disclosure@vulncheck.com)
https://blog.csdn.net/qq_41904294/article/details/144240396(134c704f-9b21-4f2e-91b3-4a467353bcc0)
https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md(134c704f-9b21-4f2e-91b3-4a467353bcc0)
https://www.vulncheck.com/advisories/st-joes-erp-system-sqli(134c704f-9b21-4f2e-91b3-4a467353bcc0)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.