Description
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WebVella WebVella-ERP
Default version status: unaffected
0 to ≤ 1.8.8affected
pkg:github/WebVella/WebVella-ERPReferences
- https://hackmd.io/@hieuPenguinnn/webvella-erp-eql-text-literal-sql-injection ↗
- https://github.com/WebVella/WebVella-ERP/blob/10315fe844198b8620494f716ed75410cd54bfe6/WebVella.Erp/Eql/EqlBuilder.Sql.cs#L580-L581 ↗
- https://github.com/WebVella/WebVella-ERP/blob/10315fe844198b8620494f716ed75410cd54bfe6/WebVella.Erp.Web/Controllers/WebApiController.cs#L64-L74 ↗
- https://www.nuget.org/packages/WebVella.Erp/1.8.8 ↗
- https://www.vulncheck.com/advisories/webvella-erp-through-1.8.8-sql-injection-via-eql-query-api ↗