CVE-2024-8774: Privilege Escalation in SIMPLE.ERP

Severity: high (CVSS 7.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-24 · updated 2026-06-17
Weakness: CWE-257

Description

The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch 6.30@a03.9, which removed the vulnerability. Versions 6.20 and 6.25 remain unpatched.

Affected products

Simple SA SIMPLE.ERP: from 6.20 before 6.30@a03.9 — fixed in 6.30@a03.9

How to fix

Upgrade to a fixed version: Simple SA SIMPLE.ERP 6.30@a03.9. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2025/03/CVE-2024-8773/
https://cert.pl/posts/2025/03/CVE-2024-8773/
https://simple.com.pl/produkty/simple-erp/dla-kogo/

Get alerted when CVE-2024-8774 or the next vulnerability affects your stack