SIMPLE.ERP SQL injection flaw enables authenticated table deletion
SQL injection flaw in SIMPLE.ERP warehouse document filters allows authenticated attackers to delete database tables, though exploitation is constrained by a 20-character input limit.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2025-9339, a SQL injection vulnerability affecting SIMPLE.ERP software versions prior to [email protected]. The flaw exists in warehouse document filtering form fields and can be exploited by authenticated users to inject malicious SQL queries. Exploitation potential is significantly limited by a 20-character constraint on form field inputs, restricting the scope of viable attack payloads.
Researchers identified that the character limit permits deletion of database tables with names up to 6 characters in length. However, no method was discovered to exfiltrate data within the query character constraints, reducing the severity of potential information disclosure. The vulnerability requires valid user credentials to exploit, limiting the attack surface to insider threats or compromised accounts.
The issue was responsibly reported by Kamil Dąbkowski and has been addressed in SIMPLE.ERP version [email protected] and later. Organizations running affected versions should prioritize upgrading to the patched release to eliminate this SQL injection risk.
Mentioned in this report
Detection guidance
Possible SQL Injection Attempt Against ERP Warehouse Document Filter Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to warehouse/document filter endpoints containing SQL metacharacters or keywords indicative of SQL injection attempts against SIMPLE.ERP-style form fields. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible SQL Injection Attempt Against ERP Warehouse Document Filter Endpoint
id: 182b178e-2aea-5e17-8370-2387c82fec6c
status: experimental
description: Detects HTTP requests with SQL injection style payloads (UNION, DROP,
comment sequences, quote breakouts) sent to warehouse or document filter form parameters,
consistent with exploitation of CVE-2025-9339 style SQL injection in ERP filtering
forms.
references:
- CVE-2025-9339
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- warehouse
- document
- filter
selection_payload:
cs-uri-query|contains:
- DROP TABLE
- UNION SELECT
- ''' OR '''
- 1=1
- --
- ;--
- xp_cmdshell
condition: selection_endpoint and selection_payload
falsepositives:
- Legitimate search or filter values that happen to contain SQL-like keywords (e.g.
product names containing 'union' or 'select')
- Automated vulnerability scanners performing authorized penetration testing
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-9339
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs