WebVella ERP up through version 1.8.8 contains an SQL injection flaw in its EQL query API. The problem occurs when an authenticated user supplies a specially crafted single‑quoted text literal that is inserted directly into the WHERE clause of an SQL statement without proper sanitization. This allows the attacker to append arbitrary SQL fragments and execute them against the database, granting the ability to read data in any table, especially the users and roles tables, resulting in a loss of confidentiality.

The vulnerability affects WebVella ERP version 1.8.8. No other variations or later releases are noted as affected.

According to the CVSS score of 7.1 the flaw has a high severity and requires authentication; an attacker must have valid credentials to exploit it. While an EPSS value and KEV listing are not available, these omissions do not lessen the potential impact. The exploitation chain is straightforward: an authenticated user posts a crafted text literal to the /api/v3/en_US/eql endpoint, causing the server to execute the injected SQL and return unauthorized data.