CVE-2025-46052
📋 TL;DR
An error-based SQL injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands by injecting malicious payloads into the DEL form field in POST requests to /StockCounts.php. This enables extraction of sensitive database information including user credentials, financial data, and business records. All organizations running vulnerable WebERP installations are affected.
💻 Affected Systems
- WebERP
📦 What is this software?
Weberp by Weberp
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, authentication bypass, and potential remote code execution through database functions.
Likely Case
Extraction of sensitive business data, user credentials, financial records, and customer information leading to data breach and business disruption.
If Mitigated
Limited data exposure if proper input validation and database permissions are implemented, but still represents significant security risk.
🎯 Exploit Status
The vulnerability requires no authentication and has publicly available proof-of-concept code, making it trivial for attackers to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.weberp.org/
Restart Required: No
Instructions:
1. Monitor WebERP vendor website for security updates. 2. Apply any available patches immediately. 3. Consider upgrading to a newer version if available. 4. Implement input validation and parameterized queries as temporary mitigation.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to reject malicious SQL characters in the DEL parameter
# Example PHP input validation
$del_param = $_POST['DEL'];
if (!preg_match('/^[a-zA-Z0-9_]+$/', $del_param)) {
die('Invalid input');
}
Web Application Firewall Rules
linuxDeploy WAF rules to block SQL injection patterns in POST requests to /StockCounts.php
# Example ModSecurity rule
SecRule ARGS_POST:DEL "@rx (union|select|insert|update|delete|drop|create|alter)" \
"id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
🧯 If You Can't Patch
- Implement network segmentation to isolate WebERP from internet access
- Deploy a web application firewall with SQL injection detection rules
🔍 How to Verify
Check if Vulnerable:
Send a POST request to /StockCounts.php with DEL parameter containing SQL injection payload like ' OR '1'='1 and observe database error responsesCheck Version:
# Check WebERP version
cat /path/to/weberp/ChangeLog | grep -i version
# Or check config files for version informationVerify Fix Applied:
Test with same SQL injection payloads and verify they are rejected or sanitized without database errors📡 Detection & Monitoring
Log Indicators:
- POST requests to /StockCounts.php with unusual DEL parameter values
- Database error messages in application logs containing SQL syntax errors
- Multiple failed login attempts following SQL injection attempts
Network Indicators:
- Unusual database query patterns from web server
- Large data transfers from database to external IPs
- SQL keywords in POST request parameters
SIEM Query:
source="web_server_logs" AND uri_path="/StockCounts.php" AND (DEL="*union*" OR DEL="*select*" OR DEL="*insert*" OR DEL="*' OR '*" OR DEL="*;--*")