{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awebvellaerp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webvella:erp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-111700"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WebVella ERP (\u003c= 1.8.8)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","sqli","erp"],"_cs_type":"advisory","_cs_vendors":["WebVella"],"content_html":"\u003cp\u003eWebVella ERP, in all versions up to and including 1.8.8, contains a critical SQL injection vulnerability within its EQL (Entity Query Language) query API. The flaw stems from improper sanitization of WHERE-clause text literals when processing requests to the EQL engine. An authenticated attacker can supply crafted input containing single-quoted literals via the POST /api/v3/en_US/eql endpoint to break out of the intended query structure. By manipulating the EqlBuilder SQL interpolation, the attacker can execute arbitrary SQL commands against the backend database. This vulnerability poses a significant risk to organizational confidentiality, as it allows unauthorized access to sensitive database entities, specifically including user and role information which could be leveraged for further privilege escalation or total system compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to perform unauthorized database queries, leading to the potential exfiltration of sensitive organizational data. Targeting of the user and role tables enables attackers to gain administrative credentials or escalate privileges within the ERP application, directly impacting data integrity and confidentiality.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade WebVella ERP to a version beyond 1.8.8 as soon as a security patch is provided by the vendor.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and parameterized queries for the EqlBuilder component to prevent raw SQL injection.\u003c/li\u003e\n\u003cli\u003eMonitor logs for the /api/v3/en_US/eql endpoint, specifically looking for POST requests containing high frequencies of single-quote characters or unusual SQL syntax patterns within the request body.\u003c/li\u003e\n\u003cli\u003eRestrict access to the /api/v3/en_US/eql endpoint to only authorized service accounts and administrative users until a patch is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:50:38Z","date_published":"2026-10-16T18:50:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-webvella-sql-injection/","summary":"Authenticated users can exploit an SQL injection vulnerability in the WebVella ERP EQL query API to exfiltrate sensitive data from user and role tables.","title":"SQL Injection in WebVella ERP EQL API","url":"https://feed.craftedsignal.io/briefs/2026-10-webvella-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:webvella:erp:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}