Executive brief
eBrigade ERP, a business management platform, contains a security flaw in its PDF generation component. An authorized user can exploit this flaw to run unauthorized database commands, potentially leading to the theft of sensitive business data, customer information, or system configuration details. This could result in a significant data breach or loss of confidentiality for the organization.
Technical details
An SQL injection vulnerability exists in eBrigade ERP 4.5 within the pdf.php component. The root cause is the improper neutralization of the 'id' parameter when processed via GET or POST requests. An authenticated attacker with network access can provide a crafted SQL payload to the 'id' parameter to bypass intended query logic. This allows for the extraction of sensitive database information, including schema details and table names, via error-based or boolean-based injection techniques. While the vulnerability was publicly disclosed with an exploit in 2019, it was formally assigned a CVE in 2026.
Affected products
- eBrigade eBrigade ERP 4.5
Timeline
- 2019-01-10: disclosed: Original exploit published on Exploit-DB (EDB-46117)
- 2026-04-12: advisory: CVE-2019-25707 published by VulnCheck/NVD