Description (CNA)
MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the log_activity function. Attackers can send POST requests to /index.php/user/log_activity with malicious SQL code in these parameters to extract sensitive database information including version and database names.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Talagasoft / MaxOn ERP | affected 8.0; affected 9.0 |
CWE
CWE-89
References
- https://www.exploit-db.com/exploits/45605
- http://www.talagasoft.com
- http://demo.maxonerp.com/
- https://www.vulncheck.com/advisories/maxon-erp-software-8-x-9-x-sql-injection-via-nomor-parameter
ADP enrichment
No English description supplied.
No references supplied.