CVE-2024-8774 Overview
CVE-2024-8774 affects the SIMPLE.ERP client, which stores the superuser password in a recoverable format. Any authenticated SIMPLE.ERP user can recover the credential and escalate privileges to a database administrator. The flaw is classified under [CWE-257]: Storing Passwords in a Recoverable Format.
The vulnerability affects SIMPLE.ERP versions 6.20 through 6.30. Only the 6.30 branch received a fix in patch 6.30@a03.9. Versions 6.20 and 6.25 remain unpatched.
Critical Impact
Any authenticated SIMPLE.ERP user can extract the superuser password from the client and gain full database administrator access, compromising confidentiality, integrity, and availability of ERP data.
Affected Products
- SIMPLE.ERP 6.20 (unpatched)
- SIMPLE.ERP 6.25 (unpatched)
- SIMPLE.ERP 6.30 (patched in 6.30@a03.9)
Discovery Timeline
- 2025-03-24 - CVE-2024-8774 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8774
Vulnerability Analysis
The SIMPLE.ERP client persists the superuser password in a format that can be reversed back to plaintext. Because the client is distributed to every authenticated user, the recovery routine and the stored credential are both reachable by low-privilege accounts. An attacker with any valid SIMPLE.ERP login can recover the credential and authenticate to the backend database as the superuser.
Database administrator access on an ERP backend exposes financial records, HR data, master data, and audit logs. It also allows an attacker to alter transactions, disable logging, or create persistent accounts within the database.
Root Cause
The root cause is reversible credential storage on the client side. Storing a shared administrative secret in a recoverable format on every workstation converts a single credential into a trust boundary shared across the entire user population. Mapped to [CWE-257], the design assumes the client environment is trusted, which does not hold for multi-user ERP deployments.
Attack Vector
Exploitation requires a valid SIMPLE.ERP account. The attacker uses the installed client, or a copy of its configuration and binaries, to run the same recovery logic the client uses at runtime. The recovered superuser password is then supplied to the database interface to authenticate as the DBA. No user interaction from another party is required, and the attack is executed over the network path already used by the client.
See the CERT Poland analysis of the related SIMPLE.ERP disclosure for background on the vendor and product context.
Detection Methods for CVE-2024-8774
Indicators of Compromise
- Database sessions authenticated as the SIMPLE.ERP superuser originating from user workstations rather than from application or administrative hosts.
- Superuser logins outside of documented maintenance windows or from accounts that historically used only standard SIMPLE.ERP roles.
- Unexpected schema changes, privilege grants, or new database accounts created by the superuser identity.
Detection Strategies
- Baseline the source hosts and time windows for legitimate superuser authentication, then alert on any deviation.
- Correlate SIMPLE.ERP application logins with backend database sessions to flag users whose database identity does not match their application identity.
- Audit reads of client configuration files and registry keys that store the credential material used by the SIMPLE.ERP client.
Monitoring Recommendations
- Enable database-side audit logging for all authentication events tied to the SIMPLE.ERP superuser account and forward those events to a central log platform.
- Monitor for execution of the SIMPLE.ERP client binaries by accounts that do not normally use the ERP.
- Track privilege changes, role grants, and creation of new logins on the SIMPLE.ERP database.
How to Mitigate CVE-2024-8774
Immediate Actions Required
- Upgrade all SIMPLE.ERP 6.30 installations to patch 6.30@a03.9 or later.
- Rotate the SIMPLE.ERP superuser password and any database credentials that may have been exposed through the client on 6.20, 6.25, or unpatched 6.30 systems.
- Restrict database-level network access so that only application servers, not end-user workstations, can authenticate as the superuser.
- Inventory all SIMPLE.ERP client installations to identify versions 6.20 and 6.25, which remain unpatched.
Patch Information
The vendor released patch 6.30@a03.9 for SIMPLE.ERP 6.30, which removes the recoverable password storage. Versions 6.20 and 6.25 have no patch available. Organizations on those branches should plan an upgrade to a patched 6.30 build. Refer to the CERT Poland advisory and Simple ERP product page for vendor context.
Workarounds
- Segment the SIMPLE.ERP database so that only application-tier hosts can reach the DBA authentication endpoint, blocking direct client-to-database superuser logins.
- Enforce least privilege for interactive SIMPLE.ERP accounts and remove local administrator rights on workstations to limit access to client configuration files.
- Increase database audit logging retention and review superuser activity daily until affected clients are upgraded or decommissioned.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
