PT-2024-33801 · Wapro · Wapro Erp Desktop

Published 2024-12-18 · Updated 2025-10-03 · CVE-2024-4996

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Wapro ERP Desktop versions prior to 8.90.0

Description: The issue involves the use of a hard-coded password for a database administrator account created during Wapro ERP installation. This allows an attacker to retrieve embedded sensitive data stored in the database. The password is the same among all Wapro ERP installations.

Recommendations: For Wapro ERP Desktop versions prior to 8.90.0, update to version 8.90.0 or later to resolve the issue. As a temporary workaround, consider changing the hard-coded password for the database administrator account to a unique and secure password until a patch is applied. Restrict access to the database to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

CVE-2024-4996

Affected Products

Wapro Erp Desktop

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-4996 · Security Note
• https://wapro.pl · Note
• https://twitter.com/CveFindCom/status/1869352541474922685 · Twitter Post
• https://twitter.com/0dayPublishing/status/1974038995014160446 · Twitter Post
• https://cert.pl/posts/2024/12/CVE-2024-4995 · Note
• https://t.me/cvedetector/13194 · Telegram Post
• https://twitter.com/CVEnew/status/1869349568543904053 · Twitter Post
• https://cert.pl/en/posts/2024/12/CVE-2024-4995 · Note