SQL Injection Vulnerability in WP ERP - WooCommerce CRM & Accounting Plugin
CVE-2024-1173

7.2HIGH

Summary

The WP ERP plugin, which offers a complete HR solution along with recruitment and job listings features, has a vulnerability related to time-based SQL Injection. This issue arises from insufficient escaping of the user-supplied 'id' parameter in all versions up to and including 1.13.1. The lack of proper preparation in the SQL query allows authenticated attackers—especially those with accounting manager or admin access—to inject additional SQL commands. This could lead to unauthorized access to sensitive information within the database, significantly impacting data integrity and confidentiality.

Affected Version(s)

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting * <= 1.13.1

References

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Edwin Siebel
.
🍪 This website uses cookies, like every other website on the internet 😕 By using our website, you consent to the use of cookies.