CVE-2023-24788: 
PHP vulnerability analysis and mitigation

NotrinosERP version 0.7 contains a SQL injection vulnerability in the /NotrinosERP/sales/customer_delivery.php endpoint via the OrderNumber parameter. The vulnerability was discovered in March 2023 and affects the sales order delivery functionality (NVD, GitHub POC).

The vulnerability exists due to improper input validation of the OrderNumber parameter in the adjust_shipping_charge function. The parameter is directly concatenated into SQL queries without sanitization in the /sales/includes/db/sales_delivery_db.inc file. The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high severity with potential for significant impact (NVD).

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary SQL commands on the underlying database. This could lead to unauthorized access to sensitive data, manipulation of database contents, and potential system compromise (GitHub POC).

The vulnerability requires authentication to exploit. A proof of concept exploit has been published demonstrating how an attacker can use time-based blind SQL injection techniques to extract database information. The exploit specifically targets the customer delivery functionality accessible through Sales - Sales Order Entry - Place Order - Make Delivery Against This Order menu path (GitHub POC, Packet Storm).

The recommended mitigation is to avoid direct string concatenation in SQL queries and implement proper input sanitization along with parameterized queries. Organizations using NotrinosERP v0.7 should consider upgrading to a newer version if available (GitHub POC).