CVE-2024-13150 describes an SQL Injection vulnerability (CWE-89) in the fayton.Pro ERP software by Fayton Software and Consulting Services. The vulnerability arises from improper neutralization of special elements in SQL commands, allowing an unauthenticated attacker to execute arbitrary SQL code remotely over the network. The CVSS 3.1 score of 9.8 reflects the ease of exploitation (network vector, no privileges or user interaction required) and the severe impact on confidentiality, integrity, and availability of the affected system. The affected versions include all releases up to 2025-09-29. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the fayton.Pro ERP database, leading to full compromise of data confidentiality, integrity, and availability. This could result in unauthorized data disclosure, data modification, or denial of service conditions within the ERP system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected ERP system and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the ERP system directly to untrusted networks.