Forminator Forms up to 1.29.2 builds the ORDER BY clause of its submission-entry query from the unquoted order_by and order filter values, so an authenticated administrator can append arbitrary SQL through the submissions export. This lets the attacker read or modify database contents beyond their role and cause denial of service.
This vulnerability affects the following application versions:
- Forminator Forms 1.13.4
- Forminator Forms 1.14.6
- Forminator Forms 1.14.7
- Forminator Forms 1.14.8
- Forminator Forms 1.14.8.1
- Forminator Forms 1.14.9
- Forminator Forms 1.14.10.1
- Forminator Forms 1.14.11
- Forminator Forms 1.14.12
- Forminator Forms 1.14.12.1
- Forminator Forms 1.15.0.1
- Forminator Forms 1.15.2
- Forminator Forms 1.15.4
- Forminator Forms 1.15.7
- Forminator Forms 1.15.9
- Forminator Forms 1.15.11
- Forminator Forms 1.15.12
- Forminator Forms 1.15.13
- Forminator Forms 1.15.14
- Forminator Forms 1.16.2
- Forminator Forms 1.17.1
- Forminator Forms 1.17.2
- Forminator Forms 1.18.1
- Forminator Forms 1.18.2
- Forminator Forms 1.19.0
- Forminator Forms 1.20.1
- Forminator Forms 1.21.0
- Forminator Forms 1.22.1
- Forminator Forms 1.23.3
- Forminator Forms 1.24.1
- Forminator Forms 1.24.4
- Forminator Forms 1.24.5
- Forminator Forms 1.24.6
- Forminator Forms 1.25.0
- Forminator Forms 1.25.1
- Forminator Forms 1.25.2
- Forminator Forms 1.26.0
- Forminator Forms 1.27.0
- Forminator Forms 1.28.0
- Forminator Forms 1.28.1
- Forminator Forms 1.29.0
- Forminator Forms 1.29.2