PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Web Vulnerabilities·Updated Oct 19, 2025

St. Joe ERP system - SQL Injection

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
3.2k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2024-13979
9.3
CVSScritical
Exploitable remotely over the internet · no authentication required.

A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
St. Joe ERP System ("圣乔ERP系统")by Hangzhou Shengqiao Technology Co. Ltd.
*
Updated Sep 9, 2026View on NVD →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

St. Joe ERP system - SQL Injection CVE-2024-13979 Scanner | S4E