CVE-2024-13147
📛 CVE Title
SQLi in Merkur Software's B2B Login Panel
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows SQL Injection.This issue affects B2B Login Panel: before 15.01.2025.
Description (MITRE) cveawg.mitre.org
Pulled from cveawg.mitre.org/api/cve/CVE-2024-13147 on 2026-06-30. Shown when MITRE's text differs from the cvelistV5 mirror.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows SQL Injection. This issue affects B2B Login Panel: before 15.01.2025.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- TR-CERT
- CVSS severity
- CRITICAL
- CVSS score
- 9.8 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 9.8 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-89 - Reserved
- 2025-01-06
- Published
- 2025-03-05 15:06 UTC
- Last updated
- 2025-03-05 15:49 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/13xxx/CVE-2024-13147.json
- Linked Threat
- CVE-2024-13147 — SQLi in Merkur Software's B2B Login Panel
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2025-03-05 14:15:35 UTC
- NVD last modified
- 2026-06-17 07:01:19 UTC
- NVD CVSS v3.1
- 9.8 / 10 CRITICAL source: iletisim@usom.gov.tr
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0038 (probability of exploitation in next 30 days)
- EPSS percentile
- 29.57% vs all CVEs — higher = more likely to be exploited, as of 2026-06-30
NVD / KEV / EPSS data refreshed 2026-06-30 19:14 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2024-54006 - Assigner
- TR-CERT
- Published
- Mar 5, 2025, 2:06:04 PM
- Updated
- Jun 1, 2026, 12:26:55 PM
- EUVD base score (CVSS 3.1)
-
9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.3800
- Vendors
- Merkur Software
- Products
-
B2B Login Panel (0 <15.01.2025)
- Aliases
-
GHSA-xhc9-5794-7px7
ENISA description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows SQL Injection. This issue affects B2B Login Panel: before 15.01.2025.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Merkur Software | B2B Login Panel |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (2) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0054 government-resource
- https://www.usom.gov.tr/bildirim/tr-25-0054 government-resource, broken-link
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0054 iletisim@usom.gov.tr
- https://www.usom.gov.tr/bildirim/tr-25-0054 iletisim@usom.gov.tr
Indicators (1)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| domain |
injection.this
|
no local data | 2026-05-18 21:19 UTC |
Remediations (23)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:www.rapid7.com
Microsoft is addressing 67 vulnerabilities this June 2025 Patch Tuesday. Learn more about the findings in this Patch Tuesday.
2026-07-08 12:29 UTC -
web:www.cve.org
Vulnerability detail for CVE-2024-13147 Notice: Expanded keyword searching of CVE Records (with limitations) is now available in the search box above. Learn more here.
2026-07-08 12:29 UTC -
web:wa.me
WhatsApp Hosted by WhatsApp 2026 © WhatsApp LLC Privacy & Terms
2026-07-08 12:29 UTC -
web:blog.qualys.com
As the year winds down, Microsoft Patch Tuesday in December arrives with essential fixes and enhancements to close vulnerabilities and boost performance.
2026-07-08 12:29 UTC -
web:www.rapid7.com
Microsoft is publishing 66 new vulnerabilities today, which is far fewer than we've come to expect in recent months. However, the lone zero-day vulnerability this month demands attention.
2026-07-08 12:29 UTC -
web:cvevault.com
CVE Vault - Search and explore Common Vulnerabilities and Exposures ( CVE ) database. Find security vulnerabilities by CVE ID, vendor, severity, and year. Stay secure with comprehensive CVE information.
2026-07-08 12:29 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-07-08 12:29 UTC -
web:www.techrepublic.com
Google patches eight high-severity Chrome vulnerabilities affecting 3.5 billion users. Here's why you should update and relaunch your browser now.
2026-05-22 08:27 UTC -
web:cyberinsider.com
Google has released Chrome 148, one of the largest security update batches in the browser's history, patching 127 vulnerabilities.
2026-05-22 08:27 UTC -
web:gbhackers.com
The update, now rolling out to users globally, upgrades Chrome to version 148..7778.178/179 for Windows and macOS, and 148..7778.178 for Linux.
2026-05-22 08:27 UTC -
web:www.anavem.com
Google Chrome 147 and Mozilla Firefox 150 security updates address critical vulnerabilities enabling arbitrary code execution attacks.
2026-05-22 08:27 UTC -
web:www.cisa.gov
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.
2026-05-22 08:27 UTC -
web:www.nist.gov
NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.
2026-05-22 08:27 UTC -
web:www.computerworld.com
Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...
2026-05-22 03:00 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-22 03:00 UTC -
web:securityonline.info
Google has released a significant security update for the Chrome stable channel, addressing 30 security fixes. The update, which brings the browser to version 147..7727.137/138 for Windows and Mac and 147..7727.137 for Linux, is set to roll out to the global user base over the coming days and weeks. This patch cycle is particularly noteworthy for the high volume of "Critical" and "High ...
2026-05-22 03:00 UTC -
web:access.redhat.com
Learn about our open source products, services, and company. You are here
2026-05-22 03:00 UTC -
web:www.oracle.com
Oracle Critical Patch Update Advisory - October 2024 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...
2026-05-22 03:00 UTC -
web:www.rapid7.com
Microsoft is addressing 70 vulnerabilities this December 2024 Patch Tuesday. Learn more about the vulnerabilities from this month!
2026-05-22 03:00 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 03:00 UTC -
web:source.android.com
This Section contains the available Android Security Bulletins, which provide fixes for possible issues affecting Android devices.
2026-05-22 03:00 UTC -
web:cybersecuritynews.com
Google released a critical Chrome update fixing multiple high-risk vulnerabilities that could enable arbitrary code execution.
2026-05-22 03:00 UTC -
web:www.securityweek.com
Google and Mozilla announced Chrome 147 and Firefox 150 security updates that resolve critical and high-severity vulnerabilities.
2026-05-22 03:00 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2024-13147.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-05T14:47:47.999563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T14:49:06.799Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "B2B Login Panel",
"vendor": "Merkur Software",
"versions": [
{
"lessThan": "15.01.2025",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yunus ORNEK"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows SQL Injection.<p>This issue affects B2B Login Panel: before 15.01.2025.</p>"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows SQL Injection.This issue affects B2B Login Panel: before 15.01.2025."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T14:06:04.447Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"url": "https://www.usom.gov.tr/bildirim/tr-25-0054"
}
],
"source": {
"advisory": "TR-25-0054",
"defect": [
"TR-25-0054"
],
"discovery": "UNKNOWN"
},
"title": "SQLi in Merkur Software's B2B Login Panel",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2024-13147",
"datePublished": "2025-03-05T14:06:04.447Z",
"dateReserved": "2025-01-06T13:42:31.188Z",
"dateUpdated": "2025-03-05T14:49:06.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}