WP ERP HR Solution Vulnerable to SQL Injection

CVE-2024-0913

What is CVE-2024-0913?

The WP ERP plugin, a comprehensive solution for human resources and accounting on WordPress, is susceptible to a time-based SQL injection through the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to and including 1.12.9. This vulnerability arises from inadequate escaping of the user-input parameters 'status' and 'customer_id', coupled with insufficient preparation in the existing SQL query. Authenticated attackers holding accounting manager or admin privileges can exploit this security flaw to inject additional SQL statements into existing queries, potentially allowing them to retrieve sensitive data from the database.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References