PT-2021-24165 · Dalmark Systems · Systeam

Published 2021-12-21 · Updated 2021-12-27 · CVE-2021-44874

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dalmark Systems Systeam version 2.22.8 build 1724

Description: The issue concerns an insecure design in the report build feature via SQL query. The Systeam application, an ERP system, uses a mixed architecture combining SaaS tenant and user management with on-premise database and web application counterparts. Specifically, the bi report module exposes direct SQL commands through POST data for report generation. A malicious actor can exploit the bi report endpoint as a direct SQL prompt under an authenticated user.

Recommendations: For version 2.22.8 build 1724, consider restricting access to the bi report module to minimize the risk of exploitation. As a temporary workaround, avoid using the bi report endpoint for report generation until a fix is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-44874

Affected Products

Systeam

References · 3

• https://osv.dev/vulnerability/CVE-2021-44874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44874 · Security Note
• https://systeam.com.br/cve/insecure%20design%20-%20sql%20manipulation-en.txt · Vendor Advisory