A flaw in eBrigade ERP 4.5’s pdf.php file enables an authenticated user to inject malicious SQL into the id parameter, allowing the execution of arbitrary queries. The vulnerability can expose sensitive database content, alter data, or serve as a foothold for further attacks. The weakness is a classic SQL injection, classified as CWE‑89. The attack directly threatens the confidentiality and integrity of data controlled by the application.

Only eBrigade ERP version 4.5 is documented as vulnerable. The problem resides in the pdf.php component of that release; no other product variants or later releases are indicated as affected.

The CVSS score of 7.1 signals a high-severity issue. No EPSS value is available and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation is known. Attackers must first authenticate to the application to access pdf.php; once authenticated, a crafted GET request with malicious SQL can be sent to retrieve or modify database information. The exploitation process requires moderate effort but offers significant payoff, making the threat appreciable.