Unrated
WP ERP < 1.12.4 - Admin+ SQL Injection
CVE-2023-2744
First seen on SecPulse
Original description The description as published by the source.
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the type parameter in the erp/v1/accounting/v1/people REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
References
- advisory github.com
- advisory nvd.nist.gov
- report wpscan.com
- web packetstormsecurity.com
- web wordpress.org