SQLi in Fayton Software's fayton.pro ERP

Successful exploitation of CVE-2024-13150 could allow an attacker to bypass authentication mechanisms and gain unauthorized access to sensitive data stored within the fayton.Pro ERP database. This includes customer information, financial records, and potentially other confidential business data. The attacker could modify, delete, or exfiltrate this data, leading to significant financial and reputational damage. Furthermore, depending on the database configuration and permissions, an attacker might be able to leverage the SQL injection to execute arbitrary commands on the underlying server, potentially leading to complete system compromise and lateral movement within the network. This vulnerability shares similarities with other SQL injection attacks where attackers have gained control of entire systems by exploiting database vulnerabilities.

Organizations utilizing fayton.Pro ERP, particularly those with sensitive financial or customer data, are at significant risk. Businesses relying on older, unpatched versions of the ERP system are especially vulnerable. Shared hosting environments where multiple users share the same database instance are also at increased risk, as a compromise of one user's account could potentially lead to the compromise of the entire database.

• linux / server: Monitor fayton.Pro ERP application logs for unusual SQL query patterns or error messages indicative of injection attempts. Use journalctl -f to monitor real-time log activity.

journalctl -f -u faytonpro_erp

• generic web: Use curl to test vulnerable endpoints with common SQL injection payloads (e.g., ' OR '1'='1).

curl 'http://erp.example.com/endpoint?param=' OR '1'='1'

• database (mysql): If direct database access is possible, run a query to check for unauthorized users or modified data.

SELECT user, host FROM mysql.user WHERE user NOT IN ('root');

1. 2025-09-29Disclosure

   disclosure

2. 2025-09-29Patch

   patch

1. 予約済み2025-01-06
2. 公開日2025-09-29
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2024-13150 is to immediately upgrade to version 20250929.0.1 of fayton.Pro ERP. Prior to upgrading, it is highly recommended to create a full backup of the database and system configuration to facilitate rollback in case of unforeseen issues. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious requests. Additionally, review and restrict database user permissions to minimize the potential impact of a successful attack. After upgrading, verify the fix by attempting a SQL injection attack on vulnerable endpoints and confirming that the input is properly sanitized.