SQL Injection in WebVella ERP EQL API

WebVella ERP, in all versions up to and including 1.8.8, contains a critical SQL injection vulnerability within its EQL (Entity Query Language) query API. The flaw stems from improper sanitization of WHERE-clause text literals when processing requests to the EQL engine. An authenticated attacker can supply crafted input containing single-quoted literals via the POST /api/v3/en_US/eql endpoint to break out of the intended query structure. By manipulating the EqlBuilder SQL interpolation, the attacker can execute arbitrary SQL commands against the backend database. This vulnerability poses a significant risk to organizational confidentiality, as it allows unauthorized access to sensitive database entities, specifically including user and role information which could be leveraged for further privilege escalation or total system compromise.

Impact

Successful exploitation allows an authenticated user to perform unauthorized database queries, leading to the potential exfiltration of sensitive organizational data. Targeting of the user and role tables enables attackers to gain administrative credentials or escalate privileges within the ERP application, directly impacting data integrity and confidentiality.

Recommendation

• Upgrade WebVella ERP to a version beyond 1.8.8 as soon as a security patch is provided by the vendor.
• Implement strict input validation and parameterized queries for the EqlBuilder component to prevent raw SQL injection.
• Monitor logs for the /api/v3/en_US/eql endpoint, specifically looking for POST requests containing high frequencies of single-quote characters or unusual SQL syntax patterns within the request body.
• Restrict access to the /api/v3/en_US/eql endpoint to only authorized service accounts and administrative users until a patch is applied.