CVE-2024-13151

Name of the Vulnerable Software and Affected Versions Logo Software Retail Sales Management versions through 20250918 Logo Software Diva versions through 4.56.00.00

Description A SQL injection issue exists in Logo Software Retail Sales Management and Diva due to improper neutralization of special elements used in an SQL command. This allows for potential authorization bypass through user-controlled SQL primary keys. The vulnerability is a blind SQL injection, CAPEC-7.

Recommendations Logo Software Retail Sales Management versions prior to 20250918: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Logo Software Diva versions prior to 4.56.00.00: At the moment, there is no information about a newer version that contains a fix for this vulnerability.