ERP Complete HR, Accounting and CRM Suite SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress. This vulnerability affects all versions through 1.17.5 and allows authenticated attackers with HR Manager-level access to manipulate SQL queries. The issue arises from inadequate escaping of user-supplied data in the 'orderby' parameter, enabling the injection of additional SQL commands that could be used to extract sensitive information from the database.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive database information.

Reproduction

To reproduce this vulnerability, an authenticated user with the 'erp_list_employee' capability (granted to HR Manager-level users and above) can send a request to a vulnerable endpoint with the 'orderby' parameter. The lack of proper input sanitization allows for the injection of malicious SQL code, which is then executed by the database.

Remediation

Users are advised to update the ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin to version 1.17.6 or a newer patched version.