Exploit for Giveaway <= 1.2.2 - Authenticated SQL Injection CVE-2021-24497

Name: Exploit for Giveaway <= 1.2.2 - Authenticated SQL Injection CVE-2021-24497
Rating: 5 (363 reviews)

2021-07-20 | CVSS 6.5

## https://sploitus.com/exploit?id=WPEX-ID:A1CF08FE-943A-4F14-BEB0-25216011B538
1. Navigate in Wordpress panel to Settings -> Giveaway

2. Intercept the request in Burp Suite

3. Click on "Select" button at the very top

4. payload: (select*from(select(sleep(10)))a)

5. modify POST parameter "options%5Bpost%5D" with SQLi payload

6. the page will sleep for 10 seconds