PT-2024-15916 · WordPress · Wp Erp

Edwin Siebel

·

Published

2024-03-28

·

Updated

2025-01-30

·

CVE-2024-0913

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress versions up to, and including, 1.12.9
Description The issue is related to a time-based SQL Injection vulnerability via the "erp/v1/accounting/v1/transactions/sales" REST API endpoint. This vulnerability is caused by insufficient escaping on the status and customer id parameters and a lack of sufficient preparation on the existing SQL query. As a result, authenticated attackers with accounting manager or admin privileges and higher can append additional SQL queries into already existing queries to extract sensitive information from the database.
Recommendations For versions up to, and including, 1.12.9, consider disabling access to the "erp/v1/accounting/v1/transactions/sales" REST API endpoint until a patch is available. Additionally, restrict the use of the status and customer id parameters in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-0913

Affected Products

Wp Erp