https/ssl for internal web/app servers

we have an ERP application that can only be accessed "internally" via the private network. However, when the users login, for some admin type activities they supply SQL credentials to access an admin area of the application. by reviewing the URL this is going over HTTP not HTTPS. I presume management dont see the risk that high as only internal hackers could "sniff" the traffic, but even so, still a degree of risk. What costs are involved in buying a certificate for an internal server to mitigate this risk? need to determine the costs vs benefits to see if management will pursue such a control to mitigate the credentials being passed over the network unencrypted. given our setup i suspect the liklehood of someone sniffing credentials in transit is very low, but always a possibility. if the fix is cheap £$ then they may pursue it. (asp.net app with backend SQL server 2008 R2)