CVE-2024-11504 Overview
CVE-2024-11504 is a SQL injection vulnerability in Streamsoft Prestiż, an enterprise resource planning (ERP) product developed by StreamSoft. Multiple input fields within the application fail to sanitize user-supplied data before incorporating it into database queries. An authenticated remote attacker can inject arbitrary SQL statements through these fields. The vendor addressed the issue in version 18.1.376.37. The weakness is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Authenticated attackers can read or manipulate confidential ERP data, including financial, customer, and inventory records, through crafted SQL statements.
Affected Products
- Streamsoft Prestiż versions prior to 18.1.376.37
- Deployments exposing the ERP client to authenticated remote users
- Databases backing Streamsoft Prestiż installations
Discovery Timeline
- 2025-03-28 - CVE-2024-11504 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-11504
Vulnerability Analysis
Streamsoft Prestiż accepts user input from multiple form fields and forwards that input to the backend database without applying proper sanitization or parameterization. Because the application concatenates untrusted values directly into SQL statements, attacker-controlled characters break out of the intended query context. The exploitation requires valid credentials, so the flaw is limited to users who already hold access to the ERP interface.
The CERT Poland advisory documents the class of issues affecting Streamsoft Prestiż. Successful injection lets an attacker read or modify records outside the boundaries of their authorized role. Given the ERP nature of the target, the exposed data includes financial ledgers, invoices, customer records, and inventory tables.
Root Cause
The root cause is missing input neutralization on multiple fields consumed by SQL queries. The application does not use prepared statements or bound parameters for the affected code paths, allowing metacharacters such as single quotes, semicolons, and comment markers to alter query structure.
Attack Vector
Exploitation occurs over the network against an authenticated session. The attacker submits crafted values through vulnerable input fields in the Prestiż client or its exposed interfaces. The malicious payload is embedded in the resulting SQL query and executed by the backend database engine with the privileges of the application's database account.
No verified public proof-of-concept is available. See the CERT Poland write-up and StreamSoft product information for background on the affected software.
Detection Methods for CVE-2024-11504
Indicators of Compromise
- Database queries originating from the Prestiż application service account containing SQL metacharacters such as ', --, ;, UNION SELECT, or OR 1=1 in field values.
- Unusual SELECT volumes against sensitive tables, including customer, invoice, and general ledger tables, from a single authenticated session.
- Application error responses that reveal SQL syntax errors or stack traces following user input submissions.
Detection Strategies
- Enable database audit logging for the Prestiż backend and alert on queries containing tautologies or stacked statements from the application user.
- Deploy a web application firewall or database activity monitoring rule that flags SQL injection signatures in form submissions to Prestiż endpoints.
- Correlate authentication events with abnormal query patterns to identify low-privilege users issuing high-impact queries.
Monitoring Recommendations
- Monitor Prestiż application logs for repeated input validation failures on the same session or account.
- Review database user activity for queries touching tables outside the normal scope of the invoking user's role.
- Track version inventory to confirm all Prestiż clients and servers report build 18.1.376.37 or later.
How to Mitigate CVE-2024-11504
Immediate Actions Required
- Upgrade Streamsoft Prestiż to version 18.1.376.37 or later on all clients and servers.
- Rotate credentials for the database account used by the Prestiż application after patching.
- Review recent database audit logs for evidence of injection attempts against the affected fields.
Patch Information
StreamSoft resolved the SQL injection in Streamsoft Prestiż version 18.1.376.37. Administrators should obtain the fixed release from StreamSoft distribution channels and apply it to all affected installations. Refer to the StreamSoft product page for update procedures and to the CERT Poland advisory for coordination details.
Workarounds
- Restrict Prestiż access to trusted network segments using VPN or firewall access control lists until the patch is applied.
- Enforce least privilege on the database account backing Prestiż so injected queries cannot reach tables outside the application scope.
- Disable or tightly restrict user accounts that do not require access to the affected modules.
# Verify installed Streamsoft Prestiz version meets or exceeds the fixed build
# Replace the path below with the actual installation directory
find "/opt/streamsoft/prestiz" -name "version.txt" -exec cat {} \;
# Expected output: 18.1.376.37 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
