CVE-2024-13150: fayton.Pro ERP SQL Injection Vulnerability

CVE-2024-13150 Overview

CVE-2024-13150 is a critical SQL Injection vulnerability affecting Fayton Software and Consulting Services fayton.Pro ERP system. This vulnerability arises from improper neutralization of special elements used in SQL commands (CWE-89), allowing attackers to inject malicious SQL statements into application queries. The flaw enables unauthenticated remote attackers to potentially access, modify, or delete sensitive database information, compromise data integrity, and in severe cases, achieve full system compromise.

Critical Impact
This SQL Injection vulnerability in fayton.Pro ERP allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, and unauthorized system access.

Affected Products

fayton.Pro ERP through version 20250929

Discovery Timeline

2025-09-29 - CVE CVE-2024-13150 published to NVD
2025-09-29 - Last updated in NVD database

Technical Details for CVE-2024-13150

Vulnerability Analysis

This SQL Injection vulnerability exists in the fayton.Pro ERP application due to insufficient input validation and sanitization of user-supplied data before incorporating it into SQL queries. The vulnerability is accessible over the network without requiring authentication or user interaction, making it particularly dangerous for internet-facing deployments of the ERP system.

SQL Injection occurs when an application fails to properly validate or sanitize user input before passing it to a database query. In this case, attackers can craft malicious input containing SQL syntax that alters the intended query logic. This can lead to unauthorized data access, data manipulation, authentication bypass, and potentially remote code execution if the database server is configured with elevated privileges.

Root Cause

The root cause of CVE-2024-13150 is the improper neutralization of special elements used in SQL commands within the fayton.Pro ERP application. The application fails to adequately validate, sanitize, or parameterize user-supplied input before incorporating it into SQL queries executed against the backend database. This allows attackers to inject SQL metacharacters and additional SQL statements that are interpreted and executed by the database engine.

Attack Vector

The vulnerability is exploitable over the network by unauthenticated attackers. No user interaction is required, and the attack complexity is considered low. An attacker can send specially crafted HTTP requests containing SQL injection payloads to vulnerable endpoints within the fayton.Pro ERP application. Successful exploitation can result in complete database compromise, including unauthorized access to sensitive business data, credential theft, data modification or deletion, and potentially lateral movement within the network.

The attack typically involves identifying input fields or parameters that are vulnerable to SQL injection, then crafting payloads that either extract data through error-based, blind, or union-based injection techniques. For detailed technical information, refer to the USOM Security Notification TR-25-0304.

Detection Methods for CVE-2024-13150

Indicators of Compromise

Unusual database queries in application logs containing SQL metacharacters such as single quotes, double dashes, semicolons, or UNION SELECT statements
Error messages in web server logs indicating SQL syntax errors or database exceptions
Unexpected database access patterns or queries outside normal application behavior
Evidence of data exfiltration or unauthorized database modifications
Login attempts with SQL injection patterns in authentication fields

Detection Strategies

Deploy web application firewall (WAF) rules to detect and block common SQL injection patterns and payloads
Implement database activity monitoring to identify anomalous query patterns and unauthorized data access
Enable detailed logging on the fayton.Pro ERP application and database server to capture suspicious requests
Utilize intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

Continuously monitor web server and application logs for requests containing SQL injection indicators
Set up alerts for database errors that may indicate exploitation attempts
Implement network traffic analysis to detect patterns consistent with automated SQL injection tools
Regularly audit database access logs for unauthorized queries or data extraction

How to Mitigate CVE-2024-13150

Immediate Actions Required

Contact Fayton Software and Consulting Services to obtain any available security patches or updates
Implement input validation and sanitization at all application entry points
Deploy a web application firewall (WAF) with SQL injection protection rules
Restrict network access to the fayton.Pro ERP application to trusted networks and users only
Review and limit database user privileges following the principle of least privilege

Patch Information

Organizations should consult the USOM Security Notification TR-25-0304 for the latest guidance and contact Fayton Software and Consulting Services directly for official patches addressing this vulnerability. As the vulnerability affects fayton.Pro ERP through version 20250929, ensure your installation is updated beyond this version once a security fix becomes available.

Workarounds

Implement parameterized queries or prepared statements at the application level where possible
Deploy a web application firewall (WAF) configured with strict SQL injection detection and blocking rules
Restrict database account permissions to minimum required privileges and disable unnecessary database features
Isolate the ERP system from direct internet exposure by placing it behind a VPN or application gateway
Enable database auditing and set up real-time alerting for suspicious query patterns

bash

# Example WAF rule configuration for SQL injection protection (ModSecurity)
# Add to your web server configuration to help detect SQL injection attempts

SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/* "@detectSQLi" \
    "id:942100,\
    phase:2,\
    block,\
    capture,\
    t:none,t:urlDecodeUni,\
    msg:'SQL Injection Attack Detected',\
    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-sqli',\
    severity:'CRITICAL'"