WordPress CRM Plugin Vulnerable to Time-Based SQL Injection

CVE-2024-5792

Summary

The Houzez CRM plugin for WordPress is susceptible to a time-based SQL Injection vulnerability through the 'belong_to' parameter in the notes section. This flaw exists due to inadequate escaping of user-supplied input and a lack of sufficient preparation in the SQL query. Authenticated attackers with Custom-level (seller) access or higher can exploit this vulnerability to inject additional SQL queries into existing ones, potentially leading to the unauthorized extraction of sensitive information stored in the database. This poses significant risks to data integrity and confidentiality for users of affected versions.

References