CVE-2025-13168

Katalog CVE

CVSS 9.8 · Critical EPSS 0,37%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada ury. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional.

Rincian

Terbit di NVD

14 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058 patch
• https://github.com/ictrun/ury-vulns/blob/main/README.md exploit · advisory pihak ketiga
• https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps exploit · advisory pihak ketiga
• https://vuldb.com/?id.332456 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.683984 advisory pihak ketiga · vdb entry
• https://github.com/ury-erp/ury/releases/tag/v0.2.1 release notes
• https://vuldb.com/?ctiid.332456 permissions required · vdb entry