PT-2025-13576 · Epicor · Epicor Hcm

Malik Tawfiq · Publicado 2025-03-28 · Atualizado 2025-04-11 · CVE-2025-22953

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Epicor HCM version 2021 1.9

Description A SQL injection issue exists, specifically in the filter parameter of the "JsonFetcher.svc" endpoint. An attacker can exploit this by injecting malicious SQL payloads into the filter parameter, enabling the unauthorized execution of arbitrary SQL commands on the backend database. If certain features, like xp cmdshell, are enabled, this may lead to remote code execution.

Recommendations For Epicor HCM version 2021 1.9, consider disabling the JsonFetcher.svc endpoint or restricting access to the filter parameter until a patch is available. Avoid using the filter parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-22953

Produtos afetados

Epicor Hcm

Referências · 10

• 🔥 https://github.com/maliktawfiq/CVE-2025-22953 · Exploit
• https://tinted-hollyhock-92d.notion.site/EPICOR-HCM-Unauthenticated-Blind-SQL-Injection-CVE-2025-22953-170f1fdee211803988d1c9255a8cb904?pvs=4 · Nota
• https://t.me/cvedetector/21486 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-22953 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1905811730522865828 · Publicação no Twitter
• https://t.me/cvetracker/20227 · Publicação no Telegram
• https://t.me/ckure/15445 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-22953 · Nota de Segurança
• https://epiusers.help/t/alert-hcm-security-patch/124777 · Nota
• https://t.me/ckured/578 · Publicação no Telegram