In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.

SQL Injection in New Contact Form Widget & Shortcode [Standard] (Contact Form Widget – Contact Query, Form Maker)

The quality of data on vulnerabilities in WordPress plugins form other sources is quite poor, as a recent entry with CVE shows. The entry, CVE-2019-17072, makes this claim:

The new-contact-form-widget (aka Contact Form Widget – Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.

The source for that is hardly coherent, but the claim appears to be that the following code contains a SQL injection vulnerability with the $id variable:

324
325
326
327
328
329

//view contact query
if($action == "view-contact-query") {
	$id =(int)$_POST['id'];
	global $wpdb;
	$table_name = $wpdb->prefix . 'awp_contact_form';
	$user_searh_query_result = $wpdb->get_row( "SELECT * FROM `$table_name` WHERE `id` ='$id'" );

The problem with that is the value of the variable is limited to an integer, so the claimed payload to be used with that “union SELECT 1,state,info,4 FROM INFORMATION_SCHEMA.PROCESSLIST #” could not be included in the SQL statement. The file referenced also contains code at its beginning to stop direct access to the rest of its code.