PT-2026-3052 · Unknown · Build Smart Erp

Nehru Sethuraman · Published 2026-01-15 · Updated 2026-01-15 · CVE-2021-47777

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Build Smart ERP version 21.0817

Description The software contains an unauthenticated SQL injection issue in the login validation endpoint. Attackers can inject SQL queries using payloads like ';WAITFOR DELAY '0:0:3'-- through the eidValue parameter. This could allow manipulation of database queries and potential extraction or modification of database information. The affected API endpoint is '/login'.

Recommendations Apply input validation and sanitization to the eidValue parameter in the login validation endpoint. Implement parameterized queries or prepared statements to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-47777

Affected Products

Build Smart Erp

References · 4

• 🔥 https://exploit-db.com/exploits/50445 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47777 · Security Note
• https://twitter.com/CVEnew/status/2011926093088100809 · Twitter Post
• https://ribccs.com/solutions/solution-buildsmart · Note