CVE-2024-0913: high-severity vulnerability in wedevs ERP: Complete HR, Accounting & CRM…
WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.6%
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied status and customer_id parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with accounting manager or admin privileges and higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Related CVEs — wedevs ERP: Complete HR, Accounting & CRM…
In the same product, most dangerous first.
CVE-2024-0952HIGHWP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via idEPSS 0.9%CVE-2024-1173HIGHWP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL InjectionEPSS 0.8%CVE-2024-0608MEDIUMWP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2024-0956MEDIUMWP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL InjectionEPSS 0.5%CVE-2024-0609HIGHWP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-6666HIGHWP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_idEPSS 0.5%