CVE-2026-111700
Received Received - Intake

SQL Injection in WebVella ERP

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111700
EUVD
EUVD-2026-102991

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WebVella WebVella-ERP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in WebVella ERP versions up to 1.8.8. It allows authenticated users to inject malicious SQL code through unsanitized text literals in WHERE-clause queries via the EQL Query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, bypassing input validation and executing arbitrary SQL commands to access unauthorized data, including user and role tables.

Detection Guidance

To detect this vulnerability, monitor POST requests to /api/v3/en_US/eql for unusual SQL-like payloads in WHERE-clause text literals. Check for single-quoted literals or patterns like 'x'' OR ''1''=''1'. Inspect logs for errors from WebApiController.cs or EqlBuilder.Sql.cs components.

Impact Analysis

An attacker could exploit this to read sensitive data, modify application behavior, or gain elevated privileges. Since the vulnerable endpoint is accessible to any authenticated user, even low-privilege users can access unauthorized data across tenant boundaries. This could lead to data breaches, unauthorized modifications, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to data breaches resulting from SQL injection.

Mitigation Strategies

Immediately upgrade to a patched version of WebVella ERP beyond 1.8.8. If unavailable, restrict access to the /api/v3/en_US/eql endpoint to privileged roles only. Implement strict input validation for EQL queries and use parameterized queries in EqlBuilder.Sql.cs to prevent SQL injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart