CVE-2019-16894

CRITICAL

inoERP 4.15 - SQL Injection via Insecure Deserialization in download.php

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-16894. PoCs published by Semen Alexandrovich Lyhin.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in inoERP 4.15 by leveraging base64-encoded serialized payloads passed to the `download.php` endpoint. The payload is deserialized and executed without sanitization, allowing arbitrary SQL queries.

Description

download.php in inoERP 4.15 allows SQL injection through insecure deserialization.

Exploits (1)

exploitdb WORKING POC
by Semen Alexandrovich Lyhin · textwebappsphp
https://www.exploit-db.com/exploits/47426

This exploit demonstrates a SQL injection vulnerability in inoERP 4.15 by leveraging base64-encoded serialized payloads passed to the `download.php` endpoint. The payload is deserialized and executed without sanitization, allowing arbitrary SQL queries.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: inoERP 4.15
No auth needed
Prerequisites: Network access to the target · PHP installed locally for payload generation
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/47426

Scores

CVSS v3 9.8
EPSS 0.0302
EPSS Percentile 85.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502 CWE-89
Status published
Products (1)
inoideas/inoerp 4.15
Published Sep 26, 2019
Tracked Since Feb 18, 2026