SQL Injection Vulnerability in WP ERP - WooCommerce CRM & Accounting Plugin
CVE-2024-1173
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 2 May 2024
Summary
The WP ERP plugin, which offers a complete HR solution along with recruitment and job listings features, has a vulnerability related to time-based SQL Injection. This issue arises from insufficient escaping of the user-supplied 'id' parameter in all versions up to and including 1.13.1. The lack of proper preparation in the SQL query allows authenticated attackers—especially those with accounting manager or admin access—to inject additional SQL commands. This could lead to unauthorized access to sensitive information within the database, significantly impacting data integrity and confidentiality.
Affected Version(s)
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting * <= 1.13.1
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved