CVE-2026-111700
CVE-2026-111700 · WebVella ERP through 1.8.8 SQL Injection via EQL Query API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.
CVSS 7.1 · Alta · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
webvella-erp
- Versiones
- ≥ 0, ≤ 1.8.8: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/webvella-erp-eql-text-literal-sql-injection
- https://github.com/WebVella/WebVella-ERP/blob/10315fe844198b8620494f716ed75410cd54bfe6/WebVella.Erp/Eql/EqlBuilder.Sql.cs#L580-L581
- https://github.com/WebVella/WebVella-ERP/blob/10315fe844198b8620494f716ed75410cd54bfe6/WebVella.Erp.Web/Controllers/WebApiController.cs#L64-L74
- https://www.nuget.org/packages/WebVella.Erp/1.8.8
- https://www.vulncheck.com/advisories/webvella-erp-through-1.8.8-sql-injection-via-eql-query-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-111700