CVE-2024-13979

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13979
A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://blog.csdn.net/qq_41904294/article/details/144240396 Exploit
https://en.fofa.info/result?qbase64=5Zyj5LmURVJQ57O757uf Product
https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md Exploit
https://www.vulncheck.com/advisories/st-joes-erp-system-sqli Third Party Advisory
https://blog.csdn.net/qq_41904294/article/details/144240396 Exploit
https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md Exploit
https://www.vulncheck.com/advisories/st-joes-erp-system-sqli Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:st._joe_erp_system_project:st._joe_erp_system:-:*:*:*:*:*:*:*
History

09 Sep 2025, 18:44

Type Values Removed Values Added
First Time St. Joe Erp System Project
St. Joe Erp System Project st. Joe Erp System
References () https://blog.csdn.net/qq_41904294/article/details/144240396 - () https://blog.csdn.net/qq_41904294/article/details/144240396 - Exploit
References () https://en.fofa.info/result?qbase64=5Zyj5LmURVJQ57O757uf - () https://en.fofa.info/result?qbase64=5Zyj5LmURVJQ57O757uf - Product
References () https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md - () https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md - Exploit
References () https://www.vulncheck.com/advisories/st-joes-erp-system-sqli - () https://www.vulncheck.com/advisories/st-joes-erp-system-sqli - Third Party Advisory
CPE cpe:2.3:a:st._joe_erp_system_project:st._joe_erp_system:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

28 Aug 2025, 20:15

Type Values Removed Values Added
Summary (en) A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. (en) A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.

28 Aug 2025, 15:15

Type Values Removed Values Added
References () https://blog.csdn.net/qq_41904294/article/details/144240396 - () https://blog.csdn.net/qq_41904294/article/details/144240396 -
References () https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md - () https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md -
References () https://www.vulncheck.com/advisories/st-joes-erp-system-sqli - () https://www.vulncheck.com/advisories/st-joes-erp-system-sqli -

27 Aug 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-27 22:15

Updated : 2025-09-09 18:44

NVD link : CVE-2024-13979

Mitre link : CVE-2024-13979

CVE.ORG link : CVE-2024-13979

JSON object : View

Products Affected

st._joe_erp_system_project

  • st._joe_erp_system
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')