Contact Form by Supsystic, f1c090a2a0b46f722a35c4314edafcc14ee8956c

CVE, Research URL: f1c090a2a0b46f722a35c4314edafcc14ee8956c
Home page URL: Security reports for Contact Form by Supsystic
Application: Contact Form by Supsystic
Published on: Feb 08, 2021
Research Description: Contact Form by Supsystic [contact-form-by-supsystic] < 1.7.11 Contact Form by Supsystic <= 1.7.10 - SQL Injections The Contact Form by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' and 'sord' parameters in versions up to, and including, 1.7.10 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 1.7.11.
Status: vulnerable