Listen to this Post
The vulnerability stems from insufficient parameter validation in several endpoints of DetailDescriptionERP versions prior to 16.8.0 and 15.100.0. Attackers can inject malicious SQL payloads into user-supplied parameters that are directly incorporated into database queries without proper sanitization. By leveraging time‑based blind SQL injection, an adversary can use conditional statements like `IF(condition, SLEEP(5), 0)` to measure response delays and infer boolean states. Similarly, boolean‑based blind injection uses crafted inputs that cause the application to return different HTTP responses or content depending on whether a condition evaluates to true or false. For example, an attacker might inject `’ AND (SELECT COUNT() FROM users) > 0 — ` to test for existence of data. Because no error messages are exposed, the blind techniques are necessary to extract information such as database schema, table names, or credentials. The vulnerable endpoints include REST API routes and web forms that process parameters like id, search, or `filter` without parameterized queries or input validation. The issue was addressed in versions 15.100.0 and 16.8.0 by implementing prepared statements and rigorous input validation across all affected endpoints.
Platform: DetailDescriptionERP
Version: prior 16.8.0
Vulnerability : blind SQL injection
Severity: Critical
date: March 20 2026
Prediction: March 23 2026
What Undercode Say:
Test time‑based blind injection on vulnerable endpoint curl -i "https://target.com/api/users?id=1' AND (SELECT SLEEP(5)) -- -" Boolean‑based test – expect different response lengths curl "https://target.com/api/products?search=test' AND '1'='1" curl "https://target.com/api/products?search=test' AND '1'='2" Extract database version using conditional delays curl "https://target.com/api/orders?filter=id' AND IF(SUBSTRING(VERSION(),1,1)='8',SLEEP(5),0) -- -"
Exploit:
An unauthenticated attacker can craft HTTP requests to vulnerable endpoints, injecting SQL payloads that leverage time or boolean differences. By automating the process, they can enumerate database contents—including user credentials, configuration data, and other sensitive records—without triggering error messages.
Protection from this CVE
Upgrade to DetailDescriptionERP version 15.100.0 or 16.8.0 immediately. If upgrade is not possible, apply web application firewall (WAF) rules to block SQL‑like patterns, enforce strict input validation, and ensure all database queries use parameterized statements or stored procedures.
Impact:
Successful exploitation allows attackers to read arbitrary data from the database, potentially leading to full compromise of the ERP system. This includes exposure of user credentials, financial records, and business‑critical information, which can result in data breaches, account takeover, and further lateral movement within the organization.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
