未評価
WP ERP < 1.12.4 - Admin+ SQL Injection
CVE-2023-2744
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the type parameter in the erp/v1/accounting/v1/people REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- report wpscan.com
- web packetstormsecurity.com
- web wordpress.org