Non évaluée
WP ERP < 1.12.4 - Admin+ SQL Injection
CVE-2023-2744
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the type parameter in the erp/v1/accounting/v1/people REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Références
- advisory github.com
- advisory nvd.nist.gov
- report wpscan.com
- web packetstormsecurity.com
- web wordpress.org