CVE-2024-13979

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13979
A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://blog.csdn.net/qq_41904294/article/details/144240396 Exploit
https://en.fofa.info/result?qbase64=5Zyj5LmURVJQ57O757uf Product
https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md Exploit
https://www.vulncheck.com/advisories/st-joes-erp-system-sqli Third Party Advisory
https://blog.csdn.net/qq_41904294/article/details/144240396 Exploit
https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md Exploit
https://www.vulncheck.com/advisories/st-joes-erp-system-sqli Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:st._joe_erp_system_project:st._joe_erp_system:-:*:*:*:*:*:*:*
History

17 Jun 2026, 07:03

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de inyección SQL existe en el sistema ERP St. Joe ('??ERP??') que permite a atacantes remotos no autenticados ejecutar comandos SQL arbitrarios a través de solicitudes HTTP POST manipuladas al endpoint de inicio de sesión. La aplicación no logra sanear adecuadamente la entrada proporcionada por el usuario antes de incorporarla en las consultas SQL, lo que permite la manipulación directa de la base de datos backend. La explotación exitosa puede resultar en acceso no autorizado a datos, modificación de registros o interrupción limitada del servicio. Un rango de versiones afectadas no está definido. La evidencia de explotación fue observada por primera vez por la Shadowserver Foundation el 14 de abril de 2025 UTC.

09 Sep 2025, 18:44

Type Values Removed Values Added
References () https://blog.csdn.net/qq_41904294/article/details/144240396 - () https://blog.csdn.net/qq_41904294/article/details/144240396 - Exploit
References () https://en.fofa.info/result?qbase64=5Zyj5LmURVJQ57O757uf - () https://en.fofa.info/result?qbase64=5Zyj5LmURVJQ57O757uf - Product
References () https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md - () https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md - Exploit
References () https://www.vulncheck.com/advisories/st-joes-erp-system-sqli - () https://www.vulncheck.com/advisories/st-joes-erp-system-sqli - Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:st._joe_erp_system_project:st._joe_erp_system:-:*:*:*:*:*:*:*
First Time St. Joe Erp System Project st. Joe Erp System
St. Joe Erp System Project

28 Aug 2025, 20:15

Type Values Removed Values Added
Summary (en) A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. (en) A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.

28 Aug 2025, 15:15

Type Values Removed Values Added
References () https://blog.csdn.net/qq_41904294/article/details/144240396 - () https://blog.csdn.net/qq_41904294/article/details/144240396 -
References () https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md - () https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md -
References () https://www.vulncheck.com/advisories/st-joes-erp-system-sqli - () https://www.vulncheck.com/advisories/st-joes-erp-system-sqli -

27 Aug 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-27 22:15

Updated : 2026-06-17 07:03

NVD link : CVE-2024-13979

Mitre link : CVE-2024-13979

CVE.ORG link : CVE-2024-13979

JSON object : View

Products Affected

st._joe_erp_system_project

  • st._joe_erp_system
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')