Vulnerability · Published Jan 15, 2026 · Assigned by VulnCheck
CVE-2021-47777Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated)
High 8.2
In plain English
A high-severity SQL injection in Build Smart ERP from Ribccs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.3%top 83.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint. Attackers can inject stacked SQL queries using payloads like ';WAITFOR DELAY '0:0:3'-- to manipulate database queries and potentially extract or modify database information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ribccs | Build Smart ERP | 21.0817 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-50445 exploit
- Build Smart ERP Vendor Homepage product