Hyunsoo Jeong

**Name of the Vulnerable Software and Affected Versions** ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support versions prior to 1.17.5 **Description** An issue exists where authenticated attackers with the CRM Agent role, CRM Manager role, or WordPress administrator privileges, and the `erp crm list contact` capability, can perform SQL Injection. This occurs because the `erpadvancefilter` parameter is not sufficiently escaped and the corresponding SQL query is not properly prepared. The handler uses `sanitize text field`, which allows single quotes to persist, and the `erp crm contact advance filter()` function interpolates this value directly into a single-quoted SQL WHERE clause executed via `$wpdb->get results()`. This allows attackers to append additional SQL queries to extract sensitive information from the database. **Recommendations** Update to a version newer than 1.17.4. As a temporary mitigation, restrict access to the `erpadvancefilter` parameter for users with the CRM Agent role.