Simple ERP SQL Injection Vulnerability Allowing Table Deletion

A SQL injection vulnerability has been identified in the warehouse document filtering form of Simple ERP software, affecting versions prior to 6.30@a04.3. This vulnerability allows logged-in users to send payloads of up to 20 characters, with the potential to delete tables named with a maximum of 6 characters. However, exploitation does not appear to allow for data exfiltration within the query character limit.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of database tables, potentially causing data loss and disruption of application functionality.