CVE-2024-13150: fayton.Pro ERP SQL Injection Vulnerability

CVE-2024-13150 Overview

CVE-2024-13150 is a critical SQL Injection vulnerability affecting Fayton Software and Consulting Services fayton.Pro ERP system. This vulnerability arises from improper neutralization of special elements used in SQL commands (CWE-89), allowing attackers to inject malicious SQL statements into application queries. The flaw enables unauthenticated remote attackers to potentially access, modify, or delete sensitive database information, compromise data integrity, and in severe cases, achieve full system compromise.

Critical Impact

This SQL Injection vulnerability in fayton.Pro ERP allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, and unauthorized system access.

Affected Products

• fayton.Pro ERP through version 20250929

Discovery Timeline

• 2025-09-29 - CVE CVE-2024-13150 published to NVD
• 2025-09-29 - Last updated in NVD database

Technical Details for CVE-2024-13150

Vulnerability Analysis

This SQL Injection vulnerability exists in the fayton.Pro ERP application due to insufficient input validation and sanitization of user-supplied data before incorporating it into SQL queries. The vulnerability is accessible over the network without requiring authentication or user interaction, making it particularly dangerous for internet-facing deployments of the ERP system.

SQL Injection occurs when an application fails to properly validate or sanitize user input before passing it to a database query. In this case, attackers can craft malicious input containing SQL syntax that alters the intended query logic. This can lead to unauthorized data access, data manipulation, authentication bypass, and potentially remote code execution if the database server is configured with elevated privileges.

Root Cause

The root cause of CVE-2024-13150 is the improper neutralization of special elements used in SQL commands within the fayton.Pro ERP application. The application fails to adequately validate, sanitize, or parameterize user-supplied input before incorporating it into SQL queries executed against the backend database. This allows attackers to inject SQL metacharacters and additional SQL statements that are interpreted and executed by the database engine.

Attack Vector

The vulnerability is exploitable over the network by unauthenticated attackers. No user interaction is required, and the attack complexity is considered low. An attacker can send specially crafted HTTP requests containing SQL injection payloads to vulnerable endpoints within the fayton.Pro ERP application. Successful exploitation can result in complete database compromise, including unauthorized access to sensitive business data, credential theft, data modification or deletion, and potentially lateral movement within the network.

The attack typically involves identifying input fields or parameters that are vulnerable to SQL injection, then crafting payloads that either extract data through error-based, blind, or union-based injection techniques. For detailed technical information, refer to the USOM Security Notification TR-25-0304.

Detection Methods for CVE-2024-13150

Indicators of Compromise

• Unusual database queries in application logs containing SQL metacharacters such as single quotes, double dashes, semicolons, or UNION SELECT statements
• Error messages in web server logs indicating SQL syntax errors or database exceptions
• Unexpected database access patterns or queries outside normal application behavior
• Evidence of data exfiltration or unauthorized database modifications
• Login attempts with SQL injection patterns in authentication fields

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block common SQL injection patterns and payloads
• Implement database activity monitoring to identify anomalous query patterns and unauthorized data access
• Enable detailed logging on the fayton.Pro ERP application and database server to capture suspicious requests
• Utilize intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Continuously monitor web server and application logs for requests containing SQL injection indicators
• Set up alerts for database errors that may indicate exploitation attempts
• Implement network traffic analysis to detect patterns consistent with automated SQL injection tools
• Regularly audit database access logs for unauthorized queries or data extraction

How to Mitigate CVE-2024-13150

Immediate Actions Required

• Contact Fayton Software and Consulting Services to obtain any available security patches or updates
• Implement input validation and sanitization at all application entry points
• Deploy a web application firewall (WAF) with SQL injection protection rules
• Restrict network access to the fayton.Pro ERP application to trusted networks and users only
• Review and limit database user privileges following the principle of least privilege

Patch Information

Organizations should consult the USOM Security Notification TR-25-0304 for the latest guidance and contact Fayton Software and Consulting Services directly for official patches addressing this vulnerability. As the vulnerability affects fayton.Pro ERP through version 20250929, ensure your installation is updated beyond this version once a security fix becomes available.

Workarounds

• Implement parameterized queries or prepared statements at the application level where possible
• Deploy a web application firewall (WAF) configured with strict SQL injection detection and blocking rules
• Restrict database account permissions to minimum required privileges and disable unnecessary database features
• Isolate the ERP system from direct internet exposure by placing it behind a VPN or application gateway
• Enable database auditing and set up real-time alerting for suspicious query patterns

# Example WAF rule configuration for SQL injection protection (ModSecurity)
# Add to your web server configuration to help detect SQL injection attempts

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/* "@detectSQLi" \
    "id:942100,\
    phase:2,\
    block,\
    capture,\
    t:none,t:urlDecodeUni,\
    msg:'SQL Injection Attack Detected',\
    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-sqli',\
    severity:'CRITICAL'"