CVE-2026-1198
SQL Injection in SIMPLE.ERP Search Allows Authenticated Data Manipulation
Publication date: 2026-02-26
Last updated on: 2026-02-26
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| simple_sa | simple.erp | to [email protected]_u06 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-1198 is an SQL Injection vulnerability in the Simple.ERP software developed by Simple SA. It affects the search functionality within the "Obroty na kontach" (Account Turnovers) window. Due to improper input validation, an authenticated attacker can craft and execute arbitrary SQL queries on the database.'}] [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate step to mitigate this vulnerability is to update Simple.ERP to version [email protected]_u06 or later, where the SQL Injection issue in the "Obroty na kontach" window has been fixed.'}] [1]
How can this vulnerability impact me? :
This vulnerability allows an authenticated attacker to execute arbitrary SQL queries on the database, which can lead to unauthorized data access, data modification, or data deletion. Such actions can compromise the integrity and confidentiality of the database, potentially causing significant damage to the affected system and its data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know