167 matches found
CVE-2019-13292
WebERP 4.15 is affected by CVE-2019-13292. Payments.php accepts payment data in base64, decodes it, deserializes it, and then directly inserts that data into a SQL query without sanitization, exposing a SQL injection vulnerability. The issue is documented across multiple sources (Red Hat, NVD, os...
PT-2019-13243
Name of the Vulnerable Software and Affected Versions webERP version 4.15 Description A SQL Injection issue was discovered. The issue concerns the handling of payment data in the Payments.php file, which accepts data in base64 format. This data is decoded and then deserialized. The deserialized...
CVE-2019-13292: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no sanitizing checks...
WebERP 4.15 - SQL injection Exploit
Exploit for php platform in category web applications Exploit Title: Blind SQL injection in WebERP. Exploit Author: Semen Alexandrovich Lyhin https://www.linkedin.com/in/semenlyhin/ Vendor Homepage: http://www.weberp.org/ Version: 4.15 A malicious query can be sent in base64 encoding to unseriali...
WebERP 4.15 SQL Injection
Exploit Title: Blind SQL injection in WebERP. Date: June 10, 2019 Exploit Author: Semen Alexandrovich Lyhin https://www.linkedin.com/in/semenlyhin/ Vendor Homepage: http://www.weberp.org/ Version: 4.15 A malicious query can be sent in base64 encoding to unserialize function. It can be deserialize...
WebERP 4.15 - SQL injection
WebERP 4.15 - SQL injection Exploit Title: Blind SQL injection in WebERP. Date: June 10, 2019 Exploit Author: Semen Alexandrovich Lyhin https://www.linkedin.com/in/semenlyhin/ Vendor Homepage: http://www.weberp.org/ Version: 4.15 A malicious query can be sent in base64 encoding to unserialize...
WebERP 4.15 - SQL injection
Exploit Title: Blind SQL injection in WebERP. Date: June 10, 2019 Exploit Author: Semen Alexandrovich Lyhin https://www.linkedin.com/in/semenlyhin/ Vendor Homepage: http://www.weberp.org/ Version: 4.15 A malicious query can be sent in base64 encoding to unserialize function. It can be deserialize...
CVE-2018-20420
In webERP 4.15, ZCreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter...
Directory traversal
In webERP 4.15, ZCreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter...
CVE-2018-20420
In webERP 4.15, ZCreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter...
CVE-2018-20420
In webERP 4.15, ZCreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter...
CVE-2018-20420
In webERP 4.15, ZCreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter...
CVE-2018-20420
In webERP 4.15, the vulnerability CVE-2018-20420 stems from Z_CreateCompanyTemplateFile.php having Incorrect Access Control, enabling an attacker to overwrite an existing .sql file on the target site. This is achieved by creating a template and then using directory traversal in the TemplateName p...
PT-2018-15364
Name of the Vulnerable Software and Affected Versions webERP version 4.15 Description The issue is related to Incorrect Access Control in the Z CreateCompanyTemplateFile.php file, allowing the overwrite of an existing .sql file on the target web site. This can be achieved by creating a template a...
CVE-2018-20420: Incorrect Permission Assignment for Critical Resource
In webERP 4.15, ZCreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter...
CVE-2018-19434
An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. BankMatching.php has Blind SQL injection via the AmtClear parameter...
CVE-2018-19435
An issue was discovered in the Sales component in webERP 4.15. SalesInquiry.php has SQL Injection via the SortBy parameter...
CVE-2018-19436
An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter...