Contact Form by WD <= 1.13.23 – Admin+ SQLi | CVE 2023-2655 | Plugin Vulnerabilities

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

Proof of Concept

1. When editing a form, go to "Settings > MySQL Mapping".
2. Click "Add a Query" 
3. When mapping the form to the database in the next screen, intercept the request and replace either the `id` or `form_id` parameter with the payload `1%20AND%20(SELECT%205065%20FROM%20(SELECT(SLEEP(5)))zYK1)`
4. The request will run the SQL.

Affects Plugins

contact-form-maker

No known fix

References

CVE

YouTube Video

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

killr00t

Submitter

killr00t

Submitter website

http://trackmaze.blogspot.com/

Submitter twitter

Verified

Yes

WPVDB ID

b3f2d38f-8eeb-45e9-bb58-2957e416e1cd

Timeline

Publicly Published

2023-06-15 (about 2 years ago)

Added

2023-06-15 (about 2 years ago)

Last Updated

2023-06-15 (about 2 years ago)

Other

Published

Title

Published

2022-12-12

Title

Web Invoice <= 2.1.3 - Authenticated SQLi

Published

2015-07-05

Title

WTI Like Post < 1.4.3 - Unauthenticated Blind SQL Injection

Published

2025-04-25

Title

WP HRM LITE <= 1.1 - Unauthenticated SQL Injection

Published

2025-03-12

Title

Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL Injection

Published

2016-12-14

Title

Xtreme Locator Dealer Locator Plugin 1.5 – Authenticated SQL Injection