CVE-2024-0913: SQL Injection
First published: Fri Mar 29 2024(Updated: )
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied status and customer_id parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with accounting manager or admin privileges and higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WP ERP | <=1.12.9 | |
| weDevs WP ERP | <=1.12.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-0913?
CVE-2024-0913 has a critical severity rating due to its potential for SQL Injection, which could compromise database integrity.
How do I fix CVE-2024-0913?
To fix CVE-2024-0913, update the WP ERP plugin to version 1.12.10 or later, which addresses the SQL injection vulnerability.
Which versions are affected by CVE-2024-0913?
All versions of the WP ERP plugin up to and including version 1.12.9 are affected by CVE-2024-0913.
What is CVE-2024-0913?
CVE-2024-0913 is a vulnerability in the WP ERP plugin for WordPress that allows for time-based SQL Injection via a specific REST API endpoint.
Who is impacted by CVE-2024-0913?
Users of the WP ERP plugin on WordPress who have not updated to version 1.12.10 or later are at risk from CVE-2024-0913.
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/source
- agent/last-modified-date
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/tags
- agent/softwarecombine
- vendor/woocommerce
- canonical/wp erp
- vendor/wedevs
- canonical/wedevs wp erp
- version/wedevs wp erp/1.12.9