Description
MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the log_activity function. Attackers can send POST requests to /index.php/user/log_activity with malicious SQL code in these parameters to extract sensitive database information including version and database names.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Talagasoft | MaxOn ERP | 8.0, 9.0 | — |
References
- ExploitDB-45605 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter third-party-advisory