CVE-2025-13506
Published: 12 December 2025
Description
Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating System from the Database.This issue affects Nebim V3 ERP: from 2.0.59 before 3.0.1.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses execution with unnecessary privileges by enforcing least privilege on database processes to prevent OS control escalation.
Enforces access control policies that block low-privileged database access from expanding to full operating system privileges.
Implements a tamper-proof reference monitor to mediate and restrict unauthorized access attempts from the database layer to OS resources.
Security SummaryAI
CVE-2025-13506 is an Execution with Unnecessary Privileges vulnerability (CWE-250) in Nebim V3 ERP, a product of Nebim Neyir Computer Industry and Services Inc. The issue enables expanding control over the operating system from the database layer. It affects Nebim V3 ERP versions starting from 2.0.59 up to but not including 3.0.1, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by an attacker with low privileges over the network, requiring low attack complexity and no user interaction. Successful exploitation allows the attacker to achieve high impacts across confidentiality, integrity, and availability, effectively granting unnecessary elevated privileges to execute arbitrary code and expand control from the database to the full operating system.
The advisory at https://www.usom.gov.tr/bildirim/tr-25-0450 provides further details on the issue. Mitigation requires upgrading to Nebim V3 ERP version 3.0.1 or later, as the vulnerability is fixed in that release.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is explicitly an Execution with Unnecessary Privileges issue (CWE-250) allowing low-privileged network attackers to execute arbitrary code and escalate to full OS control from the database layer, directly mapping to Exploitation for Privilege Escalation.