← back
CVE-2025-13168

ury-erp ury pos_extend.py overrided_past_order_list sql injection

CVSS 5.3 MEDIUMEPSS 0.3%CWE-74CWE-89
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
14 Nov 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
ury-erp · ury
References
https://github.com/ictrun/ury-vulns/blob/main/README.mdhttps://github.com/ictrun/ury-vulns/blob/main/README.md#verification-stepshttps://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058https://github.com/ury-erp/ury/releases/tag/v0.2.1https://vuldb.com/?ctiid.332456https://vuldb.com/?id.332456https://vuldb.com/?submit.683984