Critical · published March 28, 2025
🚨 A sneaky SQL injection lurks in Epicor HCM 2021 1.9 that could let attackers run unauthorized commands – and it’s as simple as tainting a filter parameter! 🔥 Think of it like a restaurant where a waiter accidentally misreads an order and serves up a dish filled with whatever the chef wants instead of what was actually requested. In this case, the chef can prepare any dish – or in this case, execute any SQL command – because the order wasn’t properly vetted. An attacker could gain unauthorized access to your database and execute arbitrary SQL commands, which may lead to data breaches, tampering, or even remote code execution if certain features are enabled! This is absolutely devastating for your organization and could lead to significant reputational and financial damage.
Think of it like a restaurant where a waiter accidentally misreads an order and serves up a dish filled with whatever the chef wants instead of what was actually requested. In this case, the chef can prepare any dish – or in this case, execute any SQL command – because the order wasn’t properly vetted. This SQL injection vulnerability exists in the filter parameter of the JsonFetcher.svc endpoint within Epicor HCM, allowing attackers to inject malicious SQL payloads that the backend database will unwittingly execute.
An attacker could gain unauthorized access to your database and execute arbitrary SQL commands, which may lead to data breaches, tampering, or even remote code execution if certain features are enabled! This is absolutely devastating for your organization and could lead to significant reputational and financial damage. To protect your systems, patch immediately to versions 5.16.0.1033, 5.17.0.1146, or 5.18.0.573 for your respective installations. Additionally, review your configurations to disable any unnecessary features like xp_cmdshell to reduce risk. You've got this! By following these steps, you'll be on your way to securing your systems in no time! 🛡️