Description
A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hangzhou Shengqiao Technology | St. Joe ERP System ("圣乔ERP系统") | — | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- St. Joe ERP system - SQL Injection http/cves/2024/CVE-2024-13979.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://blog.csdn.net/qq_41904294/article/details/144240396 technical-description exploit
- https://github.com/adysec/POC/blob/main/wpoc/%E5%9C%A3%E4%B9%94ERP/%E5%9C%A3%E4%B9%94ERP%E7%B3%BB%E7%BB%9FSingleRowQueryConvertor%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md exploit
- https://en.fofa.info/result?qbase64=5Zyj5LmURVJQ57O757uf product
- https://www.vulncheck.com/advisories/st-joes-erp-system-sqli third-party-advisory