WP ERP HR Solution Vulnerable to SQL Injection

CVE-2024-0913

Summary

The WP ERP plugin, a comprehensive solution for human resources and accounting on WordPress, is susceptible to a time-based SQL injection through the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to and including 1.12.9. This vulnerability arises from inadequate escaping of the user-input parameters 'status' and 'customer_id', coupled with insufficient preparation in the existing SQL query. Authenticated attackers holding accounting manager or admin privileges can exploit this security flaw to inject additional SQL statements into existing queries, potentially allowing them to retrieve sensitive data from the database.

References