Vulnerability Description
A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ury | Ury | < 0.2.1 |
Related Weaknesses (CWE)
References
- https://github.com/ictrun/ury-vulns/blob/main/README.mdExploitThird Party Advisory
- https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-stepsExploitThird Party Advisory
- https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058Patch
- https://github.com/ury-erp/ury/releases/tag/v0.2.1Release Notes
- https://vuldb.com/?ctiid.332456Permissions RequiredVDB Entry
- https://vuldb.com/?id.332456Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.683984Third Party AdvisoryVDB Entry
- https://github.com/ictrun/ury-vulns/blob/main/README.mdExploitThird Party Advisory
- https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-stepsExploitThird Party Advisory
FAQ
What is CVE-2025-13168?
CVE-2025-13168 is a vulnerability with a CVSS score of 6.3 (MEDIUM). A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term caus...
How severe is CVE-2025-13168?
CVE-2025-13168 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-13168?
Check the references section above for vendor advisories and patch information. Affected products include: Ury Ury.