PT-2025-9926 · Epicor · Epicor Prophet 21

Arjun Nair · Publicado 2025-03-06 · Atualizado 2025-03-07 · CVE-2024-42844

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions EPICOR Prophet 21 (P21) versions up to 23.2.5232

Description A SQL Injection issue has been identified, allowing authenticated remote attackers to execute arbitrary SQL commands through unsanitized user input fields, potentially obtaining unauthorized information.

Recommendations For EPICOR Prophet 21 (P21) versions up to 23.2.5232, update to a version later than 23.2.5232 to resolve the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2024-42844

Produtos afetados

Epicor Prophet 21

Referências · 6

• https://twitter.com/CVEnew/status/1897912314688684092 · Publicação no Twitter
• https://gist.github.com/getHecked/dc4ae46526d181d3deb17092815b9bec · Nota
• https://twitter.com/cybercronai/status/1898131951069843808 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1897684699411017763 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1897727761763959177 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-42844 · Nota de Segurança