Threats tagged 'ghsa-fw37-9qw7-rcpc'

A SQL injection vulnerability exists in the function overrided_past_order_list of the file ury/ury/api/pos_extend.py in ury-erp ury versions up to 0.2.0. This vulnerability allows remote attackers to manipulate the search_term argument to execute arbitrary SQL commands. Public exploit code is available. Upgrading to version 0.2.1 mitigates the issue.