A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no sanitizing checks.
References
Link | Resource |
---|---|
https://www.exploit-db.com/exploits/47013 | Exploit Third Party Advisory VDB Entry |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-07-04T21:56:07
Updated: 2019-07-04T21:56:07
Reserved: 2019-07-04T00:00:00
Link: CVE-2019-13292
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-07-04T22:15:10.947
Modified: 2019-07-10T13:21:10.607
Link: CVE-2019-13292
JSON object: View
Redhat Information
No data.
CWE