CVE-2023-2744

Published: Jun 27, 2023Modified: Nov 21, 2024

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

Affected (1)

Products: Wedevs: Wp Erp

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wedevs Wp Erp	Before 1.12.4

References (4)

http://packetstormsecurity.com/files/175106/WordPress-WP-ERP-1.12.2-SQL-Injection.html

Source: contact@wpscan.com

ExploitThird Party AdvisoryVDB Entry

https://wpscan.com/vulnerability/435da8a1-9955-46d7-a508-b5738259e731

Source: contact@wpscan.com

ExploitThird Party Advisory

http://packetstormsecurity.com/files/175106/WordPress-WP-ERP-1.12.2-SQL-Injection.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://wpscan.com/vulnerability/435da8a1-9955-46d7-a508-b5738259e731

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.