This vulnerability affects the doAction function of the RMI Interface component in IAS Canias ERP 8.03. An attacker can manipulate the sessionId argument to bypass authentication controls, allowing unauthorized remote access. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. The vendor has not provided any advisory or patch, and the exploit code is publicly available.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication mechanisms in the affected ERP system, potentially gaining unauthorized access to system functions. The impact is limited to confidentiality loss, with no integrity or availability impact explicitly stated. No known exploits are reported in the wild beyond the public exploit disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, organizations should consider implementing network-level access controls to restrict exposure of the affected RMI Interface and monitor for exploitation attempts. Avoid exposing the vulnerable service to untrusted networks until a patch or official mitigation is available.