CVE-2023-24788: 
PHP vulnerability analysis and mitigation

NotrinosERP version 0.7 contains a SQL injection vulnerability in the /NotrinosERP/sales/customer_delivery.php endpoint via the OrderNumber parameter. The vulnerability was discovered in March 2023 and affects the sales order delivery functionality (NVD, GitHub POC).

The vulnerability exists due to improper input validation of the OrderNumber parameter in the adjust_shipping_charge function. The parameter is directly concatenated into SQL queries without sanitization in the /sales/includes/db/sales_delivery_db.inc file. The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high severity with potential for significant impact (NVD).

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary SQL commands on the underlying database. This could lead to unauthorized access to sensitive data, manipulation of database contents, and potential system compromise (GitHub POC).

The recommended mitigation is to avoid direct string concatenation in SQL queries and implement proper input sanitization along with parameterized queries. Organizations using NotrinosERP v0.7 should consider upgrading to a newer version if available (GitHub POC).