Epicor Prophet 21 SQL Injection Vulnerability

A SQL injection vulnerability exists in Epicor Prophet 21 (P21) versions prior to 23.2.5232. This vulnerability allows authenticated remote attackers to execute arbitrary SQL commands by exploiting unsanitized user input fields, potentially leading to unauthorized information disclosure.

Impact

Exploitation of this vulnerability could result in unauthorized access to information through executed SQL commands.

Remediation

Users are advised to upgrade to Epicor Prophet 21 version 24.1.5358. For further information, Epicor customers can refer to EpicCare article KB0138127.