Comment Rating Plugin for WordPress 'id' Parameter SQL Injection Vulnerability

Bugtraq ID:	46482
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 22 2011 12:00AM
Updated:	Feb 22 2011 12:00AM
Credit:	High-Tech Bridge SA
Vulnerable:	Bob King Comment Rating 2.9.23
Not Vulnerable:	Bob King Comment Rating 2.9.24

Comment Rating Plugin for WordPress 'id' Parameter SQL Injection Vulnerability

Comment Rating plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Comment Rating 2.9.23 is vulnerable; other versions may also be affected.

Comment Rating Plugin for WordPress 'id' Parameter SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/wp-content/plugins/comment-rating/ck-processkarma.php?path=1&action=1&id=1%20and%201=2%20--%20

Comment Rating Plugin for WordPress 'id' Parameter SQL Injection Vulnerability

Solution:
Updates are available. Please see the reference for more details.

Comment Rating Plugin for WordPress 'id' Parameter SQL Injection Vulnerability

References:

• Comment Rating Homepage (Bob King)
  
• HTB22841: SQL Injection in Comment Rating wordpress plugin ([email protected])