CVE-2025-13168

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13168", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-11-14T08:13:43.179Z", "datePublished": "2025-11-14T15:02:06.824Z", "dateUpdated": "2025-11-14T16:49:03.659Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-11-14T15:02:06.824Z"}, "title": "ury-erp ury pos_extend.py overrided_past_order_list sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "ury-erp", "product": "ury", "versions": [{"version": "0.1", "status": "affected"}, {"version": "0.2.0", "status": "affected"}, {"version": "0.2.1", "status": "unaffected"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional."}, {"lang": "de", "value": "Eine Schwachstelle wurde in ury-erp ury up to 0.2.0 gefunden. Hierbei geht es um die Funktion overrided_past_order_list der Datei ury/ury/api/pos_extend.py. Die Ver\u00e4nderung des Parameters search_term resultiert in sql injection. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit wurde der \u00d6ffentlichkeit bekannt gemacht und k\u00f6nnte verwendet werden. Das Problem kann durch ein Upgrade auf Version 0.2.1 adressiert werden. Der Patch heisst 063384e0dddfd191847cd2d6524c342cc380b058. Es wird empfohlen, die betroffene Komponente zu aktualisieren."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2025-11-14T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-11-14T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-11-14T09:19:15.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ictrun (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.332456", "name": "VDB-332456 | ury-erp ury pos_extend.py overrided_past_order_list sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.332456", "name": "VDB-332456 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.683984", "name": "Submit #683984 | ury-erp ury 0.2.0 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ictrun/ury-vulns/blob/main/README.md", "tags": ["related"]}, {"url": "https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps", "tags": ["exploit"]}, {"url": "https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058", "tags": ["patch"]}, {"url": "https://github.com/ury-erp/ury/releases/tag/v0.2.1", "tags": ["patch"]}], "tags": ["x_open-source"]}, "adp": [{"references": [{"url": "https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps", "tags": ["exploit"]}, {"url": "https://github.com/ictrun/ury-vulns/blob/main/README.md", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T16:07:32.848151Z", "id": "CVE-2025-13168", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T16:49:03.659Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13168", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T16:07:32.848151Z"}}}], "references": [{"url": "https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps", "tags": ["exploit"]}, {"url": "https://github.com/ictrun/ury-vulns/blob/main/README.md", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T16:08:16.945Z"}}], "cna": {"tags": ["x_open-source"], "title": "ury-erp ury pos_extend.py overrided_past_order_list sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "ictrun (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "ury-erp", "product": "ury", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2.0"}, {"status": "unaffected", "version": "0.2.1"}]}], "timeline": [{"lang": "en", "time": "2025-11-14T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-11-14T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-11-14T09:19:15.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.332456", "name": "VDB-332456 | ury-erp ury pos_extend.py overrided_past_order_list sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.332456", "name": "VDB-332456 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.683984", "name": "Submit #683984 | ury-erp ury 0.2.0 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ictrun/ury-vulns/blob/main/README.md", "tags": ["related"]}, {"url": "https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps", "tags": ["exploit"]}, {"url": "https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058", "tags": ["patch"]}, {"url": "https://github.com/ury-erp/ury/releases/tag/v0.2.1", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional."}, {"lang": "de", "value": "Eine Schwachstelle wurde in ury-erp ury up to 0.2.0 gefunden. Hierbei geht es um die Funktion overrided_past_order_list der Datei ury/ury/api/pos_extend.py. Die Ver\u00e4nderung des Parameters search_term resultiert in sql injection. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit wurde der \u00d6ffentlichkeit bekannt gemacht und k\u00f6nnte verwendet werden. Das Problem kann durch ein Upgrade auf Version 0.2.1 adressiert werden. Der Patch heisst 063384e0dddfd191847cd2d6524c342cc380b058. Es wird empfohlen, die betroffene Komponente zu aktualisieren."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-11-14T15:02:06.824Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13168", "state": "PUBLISHED", "dateUpdated": "2025-11-14T16:49:03.659Z", "dateReserved": "2025-11-14T08:13:43.179Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-11-14T15:02:06.824Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ury", "vendor": "ury-erp", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2.0"}, {"status": "unaffected", "version": "0.2.1"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ury:ury:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9F7BEF5-2C84-4C2D-8AB3-C3273B0E078A", "versionEndExcluding": "0.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional."}, {"lang": "es", "value": "Se ha identificado una debilidad en ury-erp ury hasta la versi\u00f3n 0.2.0. Esto afecta a la funci\u00f3n overrided_past_order_list del archivo ury/ury/API/pos_extend.py. Esta manipulaci\u00f3n del argumento search_term causa inyecci\u00f3n SQL. La explotaci\u00f3n remota del ataque es posible. El exploit se ha hecho p\u00fablico y podr\u00eda ser explotado. La actualizaci\u00f3n a la versi\u00f3n 0.2.1 puede mitigar este problema. Nombre del parche: 063384e0dddfd191847cd2d6524c342cc380b058. Se sugiere actualizar el componente afectado. El proveedor respondi\u00f3 y reaccion\u00f3 de manera muy profesional."}], "id": "CVE-2025-13168", "lastModified": "2026-10-19T13:10:00.110", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13168", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T16:07:32.848151Z", "version": "2.0.3"}}]}, "published": "2025-11-14T15:15:52.620", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/ictrun/ury-vulns/blob/main/README.md"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps"}, {"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058"}, {"source": "cna@vuldb.com", "tags": ["Release Notes"], "url": "https://github.com/ury-erp/ury/releases/tag/v0.2.1"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.332456"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.332456"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.683984"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/ictrun/ury-vulns/blob/main/README.md"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-11-15T22:07:46.922574+00:00", "updated": "2025-11-15T22:07:46.922602+00:00", "vendors": ["ury-erp", "ury-erp$PRODUCT$ury"]}