CVE-2024-13979 is a critical (CVSS 9.8) SQL injection in the St. Joe ERP system. An unauthenticated attacker can send crafted POST requests to the login endpoint and run SQL against the backend database. No affected or fixed version range is published, so contact the vendor and keep the login page off the open internet.
What's affected
The NVD record names the St. Joe ERP system (shown in Chinese as the Shengqiao ERP system) and states that the affected version range is undefined. There is no fixed version in the record.
The weakness sits in the login endpoint. User input is placed into a SQL query without proper sanitisation, so the database can be manipulated directly.
The description adds that exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC. The CVE is not in the CISA Known Exploited Vulnerabilities catalogue at the time of writing, so treat the Shadowserver note as the only exploitation signal in the record.
How to check if you're exposed
Start with inventory. Find out whether any team in your company runs St. Joe ERP, including subsidiaries and regional offices that bought software on their own.
Then check exposure:
- Find the hostnames where the ERP login page is reachable and test whether they answer from the public internet.
- Review web server and database logs for unusual POST traffic to the login endpoint, long or odd parameter values, and database errors raised during login.
- Check whether the database account used by the application can read or change more than it needs to.
The record does not give a version test, so ask the vendor which builds contain the fix.
What to do now
- Ask the vendor in writing whether your build is affected and which release fixes it. The record lists no fixed version.
- Remove public access to the login page. Put it behind a VPN or an IP allowlist until the vendor confirms a fix.
- Rotate database credentials used by the application and any credentials stored in the ERP database if you see signs of probing.
- Reduce the database account to the minimum rights the application needs.
- Add a web application firewall rule or monitoring alert for SQL error strings in login responses, as a stopgap and not a fix.
- Run a dynamic scan of the login flow after the vendor patch to confirm the injection is closed.
Why it matters
The weakness class is CWE-89, SQL injection. The application builds a query by pasting user input into it, so the database cannot tell the attacker's text from the developer's query. On a login endpoint the attacker needs no account, which is why the score is 9.8 with no privileges and no user interaction.
An ERP database usually holds finance, supplier and employee records. The NVD text names unauthorised data access, record modification and limited disruption as the outcomes. The practical fix for the code is parameterised queries, and for your network it is keeping the login page off the open internet until that fix exists.
Try it yourself
A dynamic scan finds injection flaws like this one by probing a running login page. This demo shows what the findings look like.
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-13979 exploited in the wild?
The NVD description says the Shadowserver Foundation first observed exploitation evidence on 2025-04-14 UTC. The CVE is not flagged in the CISA KEV catalogue in the record, so confirm with your own logs.
Sources
Last reviewed: 19 October 2026.
