CVE-2025-13168
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-14

Last updated on: 2026-04-29

Assigner: VulDB

Description
A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-11-14
Last Modified
2026-04-29
Generated
2026-07-06
AI Q&A
2025-11-14
EPSS Evaluated
2026-07-05
NVD
CVE-2025-13168
EUVD
EUVD-2025-197608

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ury-erp ury 0.2.0
ury-erp ury 0.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Impact Analysis

The vulnerability allows remote attackers to perform SQL injection attacks, which can lead to unauthorized access, data leakage, data modification, or disruption of the database. This can compromise the integrity, confidentiality, and availability of the affected system's data.

Mitigation Strategies

Upgrade the affected ury-erp ury component to version 0.2.1, as this version contains the patch that mitigates the SQL injection vulnerability in the overrided_past_order_list function.

Executive Summary

This vulnerability is a SQL injection in the ury-erp software up to version 0.2.0. It occurs in the function overrided_past_order_list within the file ury/ury/api/pos_extend.py. The issue arises from improper handling of the argument search_term, allowing an attacker to manipulate it to execute arbitrary SQL commands remotely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart