PT-2025-46957 · Unknown · Ury-Erp Ury

Ictrun · Published 2025-11-14 · Updated 2026-01-09 · CVE-2025-13168

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ury-erp ury versions up to 0.2.0

Description A weakness exists in ury-erp ury that allows for SQL injection. This issue is related to the manipulation of the search term argument within the overrided past order list function located in the file ury/ury/api/pos extend.py. Remote exploitation is possible, and an exploit has been publicly released.

Recommendations Upgrade to version 0.2.1 or later to address this issue.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-13168

Affected Products

Ury-Erp Ury

References · 13

• 🔥 https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps · Exploit
• 🔥 https://github.com/ictrun/ury-vulns/blob/main/README.md · Exploit
• https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058 · Patch
• https://github.com/ury-erp/ury/releases/tag/v0.2.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-13168 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13168 · Vendor Advisory
• https://t.me/cveNotify/142800 · Telegram Post
• https://twitter.com/CVEnew/status/1989355875388326338 · Twitter Post
• https://t.me/cveNotify/148218 · Telegram Post
• https://vuldb.com/?ctiid.332456 · Note
• https://twitter.com/VulmonFeeds/status/1989355893851353104 · Twitter Post
• https://vuldb.com/?submit.683984 · Note
• https://vuldb.com/?id.332456 · Note