Contact Form by WD <= 1.13.23 - Admin+ SQLi

2023-06-1500:00:00

killr00t

contact form

sql injection

admin+ functionality

mysql mapping

add a query

intercept request

JSON

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

1. When editing a form, go to "Settings > MySQL Mapping".
2. Click "Add a Query" 
3. When mapping the form to the database in the next screen, intercept the request and replace either the `id` or `form_id` parameter with the payload `1%20AND%20(SELECT%205065%20FROM%20(SELECT(SLEEP(5)))zYK1)`
4. The request will run the SQL.

JSON

Related for WPEX-ID:B3F2D38F-8EEB-45E9-BB58-2957E416E1CD