Form Maker by 10Web concatenated the asc_or_desc request parameter unescaped into the ORDER BY clause of the admin Submissions listing, allowing SQL injection (for example time-based extraction of database contents). Exploitation needs an administrator session, but the listing is reachable by a plain GET link without a nonce, so an administrator can be made to trigger it via a crafted link. Affects 1.12.33 through 1.13.3; fixed in 1.13.4.
This vulnerability affects the following application versions:
- Form Maker by 10Web 1.12.33
- Form Maker by 10Web 1.12.34
- Form Maker by 10Web 1.12.35
- Form Maker by 10Web 1.12.36
- Form Maker by 10Web 1.12.37
- Form Maker by 10Web 1.12.38
- Form Maker by 10Web 1.12.39
- Form Maker by 10Web 1.12.40
- Form Maker by 10Web 1.12.41
- Form Maker by 10Web 1.12.42
- Form Maker by 10Web 1.13.0
- Form Maker by 10Web 1.13.1
- Form Maker by 10Web 1.13.2
- Form Maker by 10Web 1.13.3