PT-2025-38315 · Logo · Logo Software Diva+1

Yunus Örnek · Published 2025-09-18 · Updated 2025-10-03 · CVE-2024-13151

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Logo Software Retail Sales Management versions through 20250918 Logo Software Diva versions through 4.56.00.00

Description A SQL injection issue exists in Logo Software Retail Sales Management and Diva due to improper neutralization of special elements used in an SQL command. This allows for potential authorization bypass through user-controlled SQL primary keys. The vulnerability is a blind SQL injection, CAPEC-7.

Recommendations Logo Software Retail Sales Management versions prior to 20250918: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Logo Software Diva versions prior to 4.56.00.00: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-566

Related Identifiers

CVE-2024-13151

Affected Products

Logo Software Diva

Logo Software Retail Sales Management

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-13151 · Security Note
• https://t.me/CVEtracker/32835 · Telegram Post
• https://twitter.com/CVEnew/status/1968923634975621520 · Twitter Post
• https://t.me/cveNotify/137305 · Telegram Post
• https://usom.gov.tr/bildirim/tr-25-0273 · Note
• https://t.me/cveNotify/135779 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1968672334652363264 · Twitter Post
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0273 · Note
• https://twitter.com/CveFindCom/status/1968648634196430976 · Twitter Post