CVE-2022-28930
📋 TL;DR
ERP-Pro v3.7.5 contains a SQL injection vulnerability in the SysEveMenuAuthPointMapper.xml component that allows attackers to execute arbitrary SQL commands. This affects all users running the vulnerable version of ERP-Pro software. Successful exploitation could lead to data theft, authentication bypass, or complete system compromise.
💻 Affected Systems
- ERP-Pro
📦 What is this software?
Erp Pro by Erp Pro Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data exfiltration, privilege escalation to administrative access, and potential remote code execution on the underlying server.
Likely Case
Unauthorized access to sensitive business data, manipulation of ERP records, and potential authentication bypass to gain administrative privileges.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing exploitation attempts.
🎯 Exploit Status
SQL injection vulnerabilities are well-understood and easily weaponized with automated tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/doc_wei01/erp-pro/issues/I515R4
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries in the SysEveMenuAuthPointMapper.xml component
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block exploitation attempts
🧯 If You Can't Patch
- Implement network segmentation to isolate ERP-Pro systems from critical infrastructure
- Enable detailed logging and monitoring for SQL injection attempts and unusual database queries
🔍 How to Verify
Check if Vulnerable:
Check if running ERP-Pro v3.7.5 and examine the SysEveMenuAuthPointMapper.xml file for SQL injection vulnerabilitiesCheck Version:
Check ERP-Pro version in application configuration or about pageVerify Fix Applied:
Test the vulnerable endpoint with SQL injection payloads to confirm they are properly blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed authentication attempts followed by successful access
- Database error messages containing SQL syntax
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, INSERT, etc.) to the vulnerable endpoint
- Unusual database connection patterns
SIEM Query:
source="erp-pro" AND (url="*SysEveMenuAuthPointMapper*" AND (request="*SELECT*" OR request="*UNION*" OR request="*INSERT*"))