PT-2026-3052 · Unknown · Build Smart Erp

Nehru Sethuraman · Publicado 2026-01-15 · Atualizado 2026-01-15 · CVE-2021-47777

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Build Smart ERP version 21.0817

Description The software contains an unauthenticated SQL injection issue in the login validation endpoint. Attackers can inject SQL queries using payloads like ';WAITFOR DELAY '0:0:3'-- through the eidValue parameter. This could allow manipulation of database queries and potential extraction or modification of database information. The affected API endpoint is '/login'.

Recommendations Apply input validation and sanitization to the eidValue parameter in the login validation endpoint. Implement parameterized queries or prepared statements to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2021-47777

Produtos afetados

Build Smart Erp

Referências · 4

• 🔥 https://exploit-db.com/exploits/50445 · Exploit
• https://twitter.com/CVEnew/status/2011926093088100809 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2021-47777 · Nota de Segurança
• https://ribccs.com/solutions/solution-buildsmart · Nota