CVE-2024-12146 Overview
CVE-2024-12146 is an SQL injection vulnerability in Finder Fire Safety's Finder ERP/CRM (New System). The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. Remote attackers can inject malicious SQL statements through application inputs without authentication or user interaction. The issue affects all Finder ERP/CRM (New System) versions before 18.12.2024. Turkey's national cyber security authority published advisory TR-25-0060 documenting the vulnerability.
Critical Impact
Unauthenticated network attackers can extract sensitive data from the ERP/CRM database by injecting crafted SQL queries through vulnerable application parameters.
Affected Products
- Finder Fire Safety Finder ERP/CRM (New System)
- All versions before 18.12.2024
- Deployments exposed to untrusted networks
Discovery Timeline
- 2025-03-06 - CVE-2024-12146 published to the National Vulnerability Database
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2024-12146
Vulnerability Analysis
The vulnerability is a classic SQL injection flaw categorized under [CWE-89]. Finder ERP/CRM (New System) fails to properly neutralize special characters in user-supplied input before incorporating that input into SQL statements. Attackers can manipulate query logic by appending SQL metacharacters such as single quotes, comments, or UNION clauses to request parameters.
Exploitation requires no authentication and no user interaction. The attack is delivered over the network, making any internet-facing instance of the affected ERP/CRM system reachable to remote adversaries. The confidentiality impact is high because attackers can read arbitrary data from the underlying database, including customer records, billing details, and credentials stored by the application.
Root Cause
The root cause is the construction of SQL queries through string concatenation or unsafe template substitution rather than parameterized queries or prepared statements. Input validation routines do not strip or escape SQL control characters, allowing attacker-controlled values to alter query syntax. The condition matches the standard pattern described in CWE-89 for improper neutralization of special elements in SQL commands.
Attack Vector
An unauthenticated remote attacker submits a crafted HTTP request to a vulnerable endpoint in the ERP/CRM web interface. The malicious payload is embedded in a parameter that is concatenated into a backend SQL query. The server executes the resulting query, returning data the attacker should not be able to access or revealing query structure through error responses. Refer to the Siber Güvenlik Advisory TR-25-0060 and the USOM Notification TR-25-0060 for additional technical context.
Detection Methods for CVE-2024-12146
Indicators of Compromise
- HTTP requests to Finder ERP/CRM endpoints containing SQL metacharacters such as ', --, ;, UNION SELECT, or OR 1=1
- Unexpected database error messages returned in HTTP responses from the application
- Anomalous outbound data transfer volumes from the ERP/CRM database tier
- Web server access logs showing repeated probing of parameters with encoded payloads (%27, %20OR%20)
Detection Strategies
- Deploy a web application firewall (WAF) with signatures tuned to detect SQL injection patterns targeting ERP/CRM URLs
- Enable database query auditing to identify unusual UNION, INFORMATION_SCHEMA, or boolean-blind query patterns
- Correlate web access logs with database logs to flag requests that produce abnormally large result sets
- Review authentication logs for unauthorized data access following suspicious request bursts
Monitoring Recommendations
- Continuously monitor HTTP request parameters for SQL syntax injected into non-SQL fields
- Alert on database errors surfaced to HTTP responses, which indicate exploitable injection points
- Track schema enumeration activity such as queries against INFORMATION_SCHEMA.TABLES or sysobjects
- Baseline normal ERP/CRM traffic patterns and alert on statistical deviations
How to Mitigate CVE-2024-12146
Immediate Actions Required
- Upgrade Finder ERP/CRM (New System) to version 18.12.2024 or later
- Restrict network access to the ERP/CRM application to trusted networks and VPN users
- Audit recent web and database logs for evidence of injection attempts or data exfiltration
- Rotate credentials and API keys stored within the ERP/CRM database if compromise is suspected
Patch Information
Finder Fire Safety released a fixed build identified by the version cutoff 18.12.2024. All releases prior to this version are vulnerable. Administrators should consult the USOM Notification TR-25-0060 for vendor coordination details and apply the patched build across all production and staging environments.
Workarounds
- Place the ERP/CRM application behind a WAF configured with SQL injection protection rules until patching completes
- Limit database account privileges used by the application to the minimum required for operation
- Disable verbose database error messages in HTTP responses to reduce information leakage to attackers
- Block direct internet exposure of the ERP/CRM interface and require VPN access for administrative use
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
