Description
webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Weberp | webERP | 4.15.1 | — |
References
- ExploitDB-48420 exploit
- Official webERP Vendor Homepage product
- webERP SourceForge Project Page product
- VulnCheck Advisory: webERP 4.15.1 - Unauthenticated Backup File Access third-party-advisory