CVE-2025-9339
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6 characters. We weren't able to identify a way to exfiltrate data within query character limit. This issue affects SIMPLE.ERP in versions before [email protected].
Risk Assessment
A logged-in user could manipulate SQL queries, potentially leading to table deletion or other unauthorized database operations, possibly causing data loss or system disruption.
Recommendation
Update SIMPLE.ERP to version [email protected] or later. Additionally, use parameterized queries and input validation in forms.
Other vulnerabilities in SIMPLE.ERP
Original NVD description (English source)
SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6 characters. We weren't able to identify a way to exfiltrate data within query character limit. This issue affects SIMPLE.ERP in versions before [email protected].
Vulnerability data from NVD (NIST) · CISA KEV · EPSS