# SQL injection flaw in SIMPLE.ERP warehouse document filters allows authenticated…

Published: 2025-10-21 · Severity: medium
Canonical: https://vorant.io/reports/9ec76973-de72-400f-b1bd-629db26939ee/sql-injection-flaw-in-simple-erp-warehouse-document-filters-allows-authenticated

> SQL injection flaw in SIMPLE.ERP warehouse document filters allows authenticated attackers to delete database tables, though exploitation is constrained by a 20-character input limit.

CERT Polska coordinated disclosure of CVE-2025-9339, a SQL injection vulnerability affecting SIMPLE.ERP software versions prior to [email protected]. The flaw exists in warehouse document filtering form fields and can be exploited by authenticated users to inject malicious SQL queries. Exploitation potential is significantly limited by a 20-character constraint on form field inputs, restricting the scope of viable attack payloads.

Researchers identified that the character limit permits deletion of database tables with names up to 6 characters in length. However, no method was discovered to exfiltrate data within the query character constraints, reducing the severity of potential information disclosure. The vulnerability requires valid user credentials to exploit, limiting the attack surface to insider threats or compromised accounts.

The issue was responsibly reported by Kamil Dąbkowski and has been addressed in SIMPLE.ERP version [email protected] and later. Organizations running affected versions should prioritize upgrading to the patched release to eliminate this SQL injection risk.

## Mentioned in this report

- Vulnerabilities: CVE-2025-9339

## Detection guidance (public sample)

### Possible SQL Injection Attempt Against ERP Warehouse Document Filter Endpoint

ATT&CK: T1190

Detects HTTP requests to warehouse/document filter endpoints containing SQL metacharacters or keywords indicative of SQL injection attempts against SIMPLE.ERP-style form fields. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible SQL Injection Attempt Against ERP Warehouse Document Filter Endpoint
id: 182b178e-2aea-5e17-8370-2387c82fec6c
status: experimental
description: Detects HTTP requests with SQL injection style payloads (UNION, DROP,
  comment sequences, quote breakouts) sent to warehouse or document filter form parameters,
  consistent with exploitation of CVE-2025-9339 style SQL injection in ERP filtering
  forms.
references:
- CVE-2025-9339
author: Vorant
tags:
- attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - warehouse
    - document
    - filter
  selection_payload:
    cs-uri-query|contains:
    - DROP TABLE
    - UNION SELECT
    - ''' OR '''
    - 1=1
    - --
    - ;--
    - xp_cmdshell
  condition: selection_endpoint and selection_payload
falsepositives:
- Legitimate search or filter values that happen to contain SQL-like keywords (e.g.
  product names containing 'union' or 'select')
- Automated vulnerability scanners performing authorized penetration testing
level: high
```

### Authenticated User Session Performing DROP TABLE via Application Database Query

ATT&CK: T1565.001

Detects database query logs showing DROP TABLE statements issued by an application service account against short-named tables shortly after form-based filter input, consistent with exploitation of a character-limited SQL injection vulnerability to delete data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Authenticated User Session Performing DROP TABLE via Application Database Query
id: 837d7e33-882e-5392-84c8-1f3ab637b822
status: experimental
description: Detects DROP TABLE statements executed through an application's database
  connection where the affected table name is unusually short (<=6 characters), matching
  the constraint observed in CVE-2025-9339 where a 20-character field limit only allowed
  deletion of short table names via injected SQL.
references:
- CVE-2025-9339
author: Vorant
tags:
- attack.t1565.001
- attack.t1078
logsource:
  category: application
  service: database
detection:
  selection:
    Query|contains: DROP TABLE
  filter_admin_tools:
    User|contains:
    - dba_admin
    - migration_svc
  condition: selection and not filter_admin_tools
falsepositives:
- Legitimate database schema migrations or maintenance scripts run by DBAs that drop
  short-named temporary or staging tables
- Automated deployment tooling that recreates tables during application updates
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-9339

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9ec76973-de72-400f-b1bd-629db26939ee/sql-injection-flaw-in-simple-erp-warehouse-document-filters-allows-authenticated.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup