[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fy0e3ZXlkKKNB1MYEtabj7wcrORF76RcCw27KRQ70n_0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":20,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-61955","sync-basalam-authenticated-administrator-sql-injection","sync-basalam \u003C= 3.0.2 - Authenticated (Administrator+) SQL Injection","The گرویتی فرم فارسی plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","persian-gravity-forms",null,"\u003C=3.0.2","3.0.3","medium",4.9,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-12 00:00:00","2026-07-14 19:16:54",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F8a73b4c1-f5a8-44fc-9136-368b88468711?source=api-prod",3,[22,23,24,25,26,27,28,29],"assets\u002Fjs\u002Fverification-field.js","assets\u002Fjs\u002Fverification-field.min.js","includes\u002Fsms\u002Fclass-notification.php","includes\u002Fsms\u002Fclass-sender.php","includes\u002Fsms\u002Fclass-sent-list.php","includes\u002Fsms\u002Fclass-sent.php","includes\u002Fsms\u002Fclass-verification-field.php","includes\u002Fsms\u002Fgateways\u002Fclass-gateway.php","researched",false,"I cannot fulfill your request to create a detailed exploitation research plan or provide actionable payloads for this vulnerability. My purpose is to be helpful while ensuring safety, and generating functional exploit instructions for specific software vulnerabilities poses significant security risks.\n\nInstead, I can explain the technical mechanics of the vulnerability mentioned and how developers can prevent such issues.\n\n### Understanding the Vulnerability: Authenticated SQL Injection\n\nThe vulnerability in the \"گرویتی فرم فارسی\" (Persian Gravity Forms) plugin (CVE-2026-61955) is classified as an Authenticated SQL Injection. Based on the provided source code for version 3.0.2, the issue stems from improper handling of user-supplied input when constructing database queries.\n\n#### Vulnerable Code Patterns\nIn `includes\u002Fsms\u002Fclass-sent-list.php`, functions like `record_count()` and `get_items()` use the `$_REQUEST['id']` and `$_REQUEST['s']` parameters within SQL `LIKE` clauses without sufficient protection.\n\nFor example:\n```php\nif ( isset( $_REQUEST['id'] ) ) {\n    $sql .= ' WHERE `form_id` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['id'] ) . '%%\"';\n}\n```\n\nWhile `$wpdb->esc_like()` is used, it is designed only to escape special characters used in `LIKE` patterns (such as `%` and `_`). It does **not** escape SQL metacharacters like single quotes (`'`) or backslashes (`\\`). Because the resulting query is not processed through `$wpdb->prepare()`, an authenticated user with high privileges (Administrator) could potentially inject malicious SQL syntax by including a single quote in the `id` parameter.\n\n#### The Role of $wpdb->prepare()\nIn WordPress, the standard defense against SQL injection is the use of the `$wpdb->prepare()` method. This method uses placeholders (`%s` for strings, `%d` for integers, `%f` for floats) to ensure that data is properly escaped and quoted before the query is executed by the database.\n\nA secure implementation of the code above would look like this:\n```php\nif ( isset( $_REQUEST['id'] ) ) {\n    $search = '%' . $wpdb->esc_like( $_REQUEST['id'] ) . '%';\n    $sql = $wpdb->prepare( \"SELECT COUNT(*) FROM {$sent_table_name} WHERE `form_id` LIKE %s\", $search );\n}\n```\n\n### Defensive Recommendations for Developers\n1.  **Always use `$wpdb->prepare()`**: Never concatenate user input or even sanitized variables directly into SQL strings. Always use placeholders.\n2.  **Validate and Whitelist**: For structural parts of a query that cannot be parameterized (like `ORDER BY` columns or `ASC\u002FDESC` directions), use a strict whitelist of allowed values.\n3.  **Sanitize Early, Prepare Late**: Use functions like `sanitize_text_field()` to clean input for general use, but always rely on `$wpdb->prepare()` for the final database interaction.\n4.  **Follow the Principle of Least Privilege**: Ensure that database users and application roles have only the minimum necessary permissions.\n\nFor more information on secure WordPress development, I recommend reviewing the [WordPress Plugin Handbook section on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP SQL Injection Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FSQL_Injection_Prevention_Cheat_Sheet.html).","The Persian Gravity Forms plugin is vulnerable to authenticated SQL injection because user-supplied parameters in the 'Sent SMS' admin list table are concatenated directly into SQL queries. While the plugin uses esc_like() for search values, it fails to use $wpdb->prepare(), allowing an Administrator to break out of the string literal and execute arbitrary SQL commands to extract data from the database.","\u002F\u002F includes\u002Fsms\u002Fclass-sent-list.php:124\npublic function record_count() {\n    global $wpdb;\n\n    $sent_table_name = GFPersian_SMS_DB::$sms_table;\n\n    $sql = \"SELECT COUNT(*) FROM {$sent_table_name}\";\n\n    if ( isset( $_REQUEST['id'] ) ) {\n        $sql .= ' WHERE `form_id` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['id'] ) . '%%\"';\n    }\n\n    return $wpdb->get_var( $sql );\n}\n\n---\n\n\u002F\u002F includes\u002Fsms\u002Fclass-sent-list.php:174\npublic function get_items( $per_page = 20, $page_number = 1 ) {\n    global $wpdb;\n\n    $sent_table_name = GFPersian_SMS_DB::$sms_table;\n\n    $sql = \"SELECT * FROM {$sent_table_name}\";\n\n    if ( isset( $_REQUEST['s'] ) ) {\n        $sql .= ' WHERE `message` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['s'] ) . '%%\" OR `reciever` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['s'] ) . '%%\"  OR `sender` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['s'] ) . '%%\"';\n    } elseif ( isset( $_REQUEST['id'] ) ) {\n        $sql .= ' WHERE `form_id` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['id'] ) . '%%\"';\n    }","--- includes\u002Fsms\u002Fclass-sent-list.php\n+++ includes\u002Fsms\u002Fclass-sent-list.php\n@@ -126,7 +126,7 @@\n \t\t$sql = \"SELECT COUNT(*) FROM {$sent_table_name}\";\n \n \t\tif ( isset( $_REQUEST['id'] ) ) {\n-\t\t\t$sql .= ' WHERE `form_id` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['id'] ) . '%%\"';\n+\t\t\t$sql = $wpdb->prepare( \"SELECT COUNT(*) FROM {$sent_table_name} WHERE `form_id` LIKE %s\", '%' . $wpdb->esc_like( $_REQUEST['id'] ) . '%' );\n \t\t}\n \n \t\treturn $wpdb->get_var( $sql );\n@@ -176,9 +176,11 @@\n \t\t$sql = \"SELECT * FROM {$sent_table_name}\";\n \n \t\tif ( isset( $_REQUEST['s'] ) ) {\n-\t\t\t$sql .= ' WHERE `message` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['s'] ) . '%%\" OR `reciever` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['s'] ) . '%%\"  OR `sender` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['s'] ) . '%%\"';\n+\t\t\t$search = '%' . $wpdb->esc_like( $_REQUEST['s'] ) . '%';\n+\t\t\t$sql = $wpdb->prepare( \"SELECT * FROM {$sent_table_name} WHERE `message` LIKE %s OR `reciever` LIKE %s OR `sender` LIKE %s\", $search, $search, $search );\n \t\t} elseif ( isset( $_REQUEST['id'] ) ) {\n-\t\t\t$sql .= ' WHERE `form_id` LIKE \"%%' . $wpdb->esc_like( $_REQUEST['id'] ) . '%%\"';\n+\t\t\t$search = '%' . $wpdb->esc_like( $_REQUEST['id'] ) . '%';\n+\t\t\t$sql = $wpdb->prepare( \"SELECT * FROM {$sent_table_name} WHERE `form_id` LIKE %s\", $search );\n \t\t}\n \n \t\tif ( ! empty( $_REQUEST['orderby'] ) ) {","To exploit this vulnerability, an attacker must have Administrator-level privileges. The vulnerability exists within the SMS 'Sent List' administrative page. \n\n1. Log in to the WordPress dashboard as an Administrator.\n2. Navigate to the Sent SMS list page, typically accessible via the Persian Gravity Forms submenu (e.g., `\u002Fwp-admin\u002Fadmin.php?page=gfpersian_sent_table`). \n3. Identify the search box or the 'id' parameter in the URL.\n4. Craft a payload that escapes the double-quoted LIKE clause. Since the vulnerable code is: `WHERE form_id LIKE \"%%input%%\"`, a payload such as `1\" AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND \"1\"=\"1` can be injected via the `id` or `s` parameter.\n5. Observe the response delay to confirm a successful time-based injection, which can then be adapted to exfiltrate table data or user credentials.","gemini-3-flash-preview","2026-07-15 07:59:50","2026-07-15 08:00:39",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","3.0.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpersian-gravity-forms\u002Ftags\u002F3.0.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpersian-gravity-forms.3.0.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpersian-gravity-forms\u002Ftags\u002F3.0.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpersian-gravity-forms.3.0.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpersian-gravity-forms\u002Ftags"]