SQL Injection Vulnerability in WP ERP - WooCommerce CRM & Accounting Plugin

CVE-2024-1173

What is CVE-2024-1173?

The WP ERP plugin, which offers a complete HR solution along with recruitment and job listings features, has a vulnerability related to time-based SQL Injection. This issue arises from insufficient escaping of the user-supplied 'id' parameter in all versions up to and including 1.13.1. The lack of proper preparation in the SQL query allows authenticated attackers—especially those with accounting manager or admin access—to inject additional SQL commands. This could lead to unauthorized access to sensitive information within the database, significantly impacting data integrity and confidentiality.

References