Description
WebIncorp ERP contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the prod_id parameter. Attackers can send GET requests to product_detail.php with malicious prod_id values to extract sensitive database information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Webincorp | WebIncorp ERP | — | — |
References
- ExploitDB-47199 exploit
- VulnCheck Advisory: WebIncorp ERP Every version SQL Injection via product_detail.php third-party-advisory