CVE-2024-21747 WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection
An attacker can execute arbitrary SQL commands via the WP ERP plugin, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21747?
CVE-2024-21747 is a high-severity SQL injection vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting, published on 8 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: from n/a through 1.12.8.
Weakness: CWE-89
Which versions are affected by CVE-2024-21747?
It affects 1 product.
Products include Wedevs Wp Erp.
How do I fix CVE-2024-21747?
No fix has been published for CVE-2024-21747 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-21747 being exploited?
There is no known exploitation of CVE-2024-21747 in the wild and no public exploit code.
Other vulnerabilities in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
- CVE-2024-6666 WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id
- CVE-2024-12812 WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information
- CVE-2024-1173 SQL injection in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support
- CVE-2024-0952 WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id
- CVE-2024-0609 Cross-site scripting in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support
Sources
Also known as GHSA-vc5m-qgwv-5c7r.