Webvella Erp
Monthly
Authenticated SQL injection in WebVella ERP through 1.8.8 allows any valid user account to read unauthorized entities, including user and role tables, by sending crafted single-quoted literals in WHERE clauses to the EQL query API at POST /api/v3/en_US/eql. The flaw is CWE-89 in EqlBuilder's unsanitized SQL string interpolation, and the CVSS vector confirms PR:L, so unauthenticated attackers cannot exploit it directly. No public exploit code was identified at time of analysis, and although CVSS 4.0 scores this 7.1, the independent assessment correctly frames it as a genuine but moderate-priority issue rather than an overstated high-CVSS finding.
Authenticated SQL injection in WebVella ERP through 1.8.8 allows any valid user account to read unauthorized entities, including user and role tables, by sending crafted single-quoted literals in WHERE clauses to the EQL query API at POST /api/v3/en_US/eql. The flaw is CWE-89 in EqlBuilder's unsanitized SQL string interpolation, and the CVSS vector confirms PR:L, so unauthenticated attackers cannot exploit it directly. No public exploit code was identified at time of analysis, and although CVSS 4.0 scores this 7.1, the independent assessment correctly frames it as a genuine but moderate-priority issue rather than an overstated high-CVSS finding.