WebVella - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/webvella/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 18:50:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in WebVella ERP EQL APIhttps://feed.craftedsignal.io/briefs/2026-10-webvella-sql-injection/Fri, 16 Oct 2026 18:50:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-webvella-sql-injection/Authenticated users can exploit an SQL injection vulnerability in the WebVella ERP EQL query API to exfiltrate sensitive data from user and role tables.WebVella ERP, in all versions up to and including 1.8.8, contains a critical SQL injection vulnerability within its EQL (Entity Query Language) query API. The flaw stems from improper sanitization of WHERE-clause text literals when processing requests to the EQL engine. An authenticated attacker can supply crafted input containing single-quoted literals via the POST /api/v3/en_US/eql endpoint to break out of the intended query structure. By manipulating the EqlBuilder SQL interpolation, the attacker can execute arbitrary SQL commands against the backend database. This vulnerability poses a significant risk to organizational confidentiality, as it allows unauthorized access to sensitive database entities, specifically including user and role information which could be leveraged for further privilege escalation or total system compromise.

Impact

Successful exploitation allows an authenticated user to perform unauthorized database queries, leading to the potential exfiltration of sensitive organizational data. Targeting of the user and role tables enables attackers to gain administrative credentials or escalate privileges within the ERP application, directly impacting data integrity and confidentiality.

Recommendation

  • Upgrade WebVella ERP to a version beyond 1.8.8 as soon as a security patch is provided by the vendor.
  • Implement strict input validation and parameterized queries for the EqlBuilder component to prevent raw SQL injection.
  • Monitor logs for the /api/v3/en_US/eql endpoint, specifically looking for POST requests containing high frequencies of single-quote characters or unusual SQL syntax patterns within the request body.
  • Restrict access to the /api/v3/en_US/eql endpoint to only authorized service accounts and administrative users until a patch is applied.
]]>highadvisoryweb-vulnerabilitysqlierp