Simple.ERP SQL Injection Vulnerability in Search Functionality

A SQL injection vulnerability has been identified in Simple.ERP, specifically within the search feature of the 'Obroty na kontach' window. This vulnerability arises from inadequate input validation, allowing authenticated attackers to craft and execute malicious SQL queries against the database. All versions of Simple.ERP prior to 6.30@A04.4_u06 are affected.

Impact

Exploitation of this vulnerability allows for arbitrary SQL query execution, potentially leading to unauthorized data access or manipulation.

Remediation

Users can upgrade to Simple.ERP version 6.30@A04.4_u06 or later to address this vulnerability.