vendor:
webERP
by:
7.5
CVSS
HIGH
Information Disclosure, SQL Injection, Cross-Site Scripting
20, 89, 79
CWE
Product Name: webERP
Affected Version From: 4.0.5
Affected Version To:
Patch Exists: NO
Related CWE:
CPE: a:weberp:weberp:4.0.5
Platforms Tested:
webERP Information Disclosure, SQL Injection, and Cross-Site Scripting Vulnerabilities
webERP is prone to information-disclosure, SQL-injection, and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may exploit the information-disclosure issue to gain access to sensitive information that may lead to further attacks. An attacker may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Mitigation:
To mitigate these vulnerabilities, it is recommended to sanitize user-supplied input and implement proper input validation to prevent information disclosure, SQL injection, and cross-site scripting attacks. Regularly updating webERP to the latest version is also advised to patch any known vulnerabilities.
