CVE-2014-125099: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-04-20T06:15Z
Repository: https://github.com/wp-plugins/i-recommend-this
Language: Other
Files changed: dot-irecommendthis.php, readme.txt
Commit date: 2014-09-24 17:35:03 +0000
Commit message: Fixed a Possible SQL injection vulnerability reported by [Oskar Adin](https://github.com/osadi) and fixed by [Danny van Kooten](https://twitter.com/DannyvanKooten).

git-svn-id: https://plugins.svn.wordpress.org/i-recommend-this/trunk@996218 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/dot-irecommendthis.php b/dot-irecommendthis.php
index 477985c..14e7a7d 100644
--- a/dot-irecommendthis.php
+++ b/dot-irecommendthis.php
@@ -1,11 +1,11 @@
 <?php
 /*
  * Plugin Name: I Recommend This
  * Plugin URI: http://www.harishchouhan.com/personal-projects/i-recommend-this/
  * Description: This plugin allows your visitors to simply recommend or like your posts instead of commment it.
- * Version: 3.7.2
+ * Version: 3.7.3
  * Author: Harish Chouhan
  * Author URI: http://www.harishchouhan.com
  * Author Email: me@harishchouhan.com
  *
  * @package WordPress
@@ -669,57 +669,74 @@ if ( ! class_exists( 'DOT_IRecommendThis' ) )
 		 * Shortcode //dot_recommended_top_posts
 		 *--------------------------------------------*/
 
 		function dot_recommended_top_posts( $atts, $content = null )
 		{
-		    // get our variable from $atts
-		    extract(shortcode_atts(array(
-		        'container' => 'li',
-		        'number' => '10',
-		        'post_type' => 'post',
-		        'year' => '',
-		        'monthnum' => '',
-		        'show_count' => '1',
-		    ), $atts));
 
-		    global $wpdb;
+			// define attributes and their defaults
+			// get our variable from $atts
+			$atts = shortcode_atts( array(
+				'container' => 'li',
+				'number' => '10',
+				'post_type' => 'post',
+				'year' => '',
+				'monthnum' => '',
+				'show_count' => '1',
+			), $atts );
 
-		    $request = "SELECT * FROM $wpdb->posts, $wpdb->postmeta";
-		    $request .= " WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";
+			global $wpdb;
+
+				// empty params array to hold params for prepared statement
+				$params = array();
 
-		    if ($year != '') {
-		        $request .= " AND YEAR(post_date) = '$year'";
-		    }
+				// build query string
+				$sql = "SELECT * FROM $wpdb->posts, $wpdb->postmeta WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";
 
-		    if ($monthnum != '') {
-		        $request .= " AND MONTH(post_date) = '$monthnum'";
-		    }
+				// add year
+				if( '' !== $atts['year'] ) {
+					$sql .= ' AND YEAR(post_date) = %d';
+					$params[] = $atts['year'];
+				}
+
+				// add monthnum
+				if( '' !== $atts['monthnum'] ) {
+					$sql .= ' AND MONTH(post_date) = %d';
+					$params[] = $atts['monthnum'];
+				}
 
-		    $request .= " AND post_status='publish' AND post_type='$post_type' AND meta_key='_recommended'";
-		    $request .= " ORDER BY $wpdb->postmeta.meta_value+0 DESC LIMIT $number";
-		    $posts = $wpdb->get_results($request);
+				// add post WHERE
+				$sql .= " AND post_status = 'publish' AND post_type = %s AND meta_key = '_recommended'";
+				$params[] = $atts['post_type'];
 
-		    $return = '';
+				// add order by and limit
+				$sql .= " ORDER BY {$wpdb->postmeta}.meta_value+0 DESC LIMIT %d";
+				$params[] = $atts['number'];
 
+				// prepare sql statement
+				$query = $wpdb->prepare( $sql, $params );
 
-		    foreach ($posts as $item) {
-		        $post_title = stripslashes($item->post_title);
-		        $permalink = get_permalink($item->ID);
-		        $post_count = $item->meta_value;
+				// execute query
+				$posts = $wpdb->get_results( $query );
 
-		        $return .= '<' . $container . '>';
-		        $return .= '<a href="' . $permalink . '" title="' . $post_title.'" rel="nofollow">' . $post_title . '</a> ';
+				$return = '';
 
-		        if ( $show_count == '1') {
-		            $return .= '<span class="votes">' . $post_count . '</span> ';
-		        }
+			foreach ($posts as $item) {
+				$post_title = stripslashes( $item->post_title );
+				$permalink = get_permalink( $item->ID );
+				$post_count = $item->meta_value;
 
-		        //$return .= get_the_post_thumbnail($item->ID, 'showcase-thumbnail');
-		        $return .= '</' . $container . '>';
+				$return .= '<' . esc_html( $atts['container'] ) . '>';
+				$return .= '<a href="' . esc_url( $permalink ) . '" title="' . esc_attr( $post_title ) .'" rel="nofollow">' . esc_html( $post_title ) . '</a> ';
 
-		    }
-		    return $return;
+				if ( $atts['show_count'] == '1') {
+					$return .= '<span class="votes">' . esc_html( $post_count ) . '</span> ';
+				}
+
+				$return .= '</' . esc_html( $atts['container'] ) . '>';
+
+			}
+			return $return;
 
 		}	//dot_recommended_top_posts
 
 
 		/*--------------------------------------------*
@@ -864,11 +881,11 @@ if ( ! class_exists( 'DOT_IRecommendThis' ) )
 		if ($column_name == 'likes')
 			echo get_post_meta($post_ID, '_recommended', true) . ' ' . __('like', 'dot');
 	}
 
 	function dot_column_register_sortable( $columns ) {
-	    $columns['likes'] = 'likes';
+		$columns['likes'] = 'likes';
 		return $columns;
 	}
 
 	function dot_column_orderby( $vars ) {
 		if ( isset( $vars['orderby'] ) && 'likes' == $vars['orderby'] ) {
@@ -881,8 +898,8 @@ if ( ! class_exists( 'DOT_IRecommendThis' ) )
 		return $vars;
 	}
 	add_filter('request', 'dot_column_orderby');
 	add_filter('manage_edit-post_sortable_columns', 'dot_column_register_sortable');
 	add_filter('manage_posts_columns', 'dot_columns_head');
-    add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);
+	add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);
 
 ?>
\ No newline at end of file
diff --git a/readme.txt b/readme.txt
index 0677524..3b3ceb0 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,42 +1,48 @@
 === Plugin Name ===
 Contributors: hchouhan, themeist, dreamsmedia, Benoit "LeBen" Burgener
 Donate link: http://themeist.co
 Tags: recommend, like, love, post, rate, rating, post rating, heart, dribbble like, tumblr like
-Requires at least: 3.7
-Tested up to: 3.9.1
-Stable tag: 3.7.2
-Last Updated: 2014-June-21
+Requires at least: 4.0
+Tested up to: 4.0
+Stable tag: 3.7.3
+Last Updated: 2014-September-24
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 This plugin allows your visitors to simply like/recommend your posts instead of comment on it.
 
-
 == Description ==
 
 This plugin allows your visitors to simply like/recommend your posts instead of comment on it.
 
+= Features of I Recommend This =
 
-= This plugin includes =
-* A counter to display the number of "like" and to vote.
-* A widget and a function to display the X most liked posts.
-* A preference pane with some options.
-* Saves Cookie as well as users IP address to disable voting on the same post again
-* Displays Number of likes on Post Edit page along with sorting option Thanks to [HSG](http://profiles.wordpress.org/HSG/)
+- A counter to display the number of "like" and to vote.
+- A widget and a function to display the X most liked posts.
+- Saves Cookie as well as users IP address to disable voting on the same post again.
+- Displays Number of likes on Post Edit page along with sorting option. [HSG](http://profiles.wordpress.org/HSG/)
+- A preference pane with some options.
 
+** Advanced Options **
 
-= Advanced Options =
 * Hide count if count is zero
 * Set a default messages when count is zero, one or more
-* Choose between a "Thumbs Up" or a "Heart" icon to allow recommending on a post
-* Disable CSS to allow you to add your own styling rules
+* Choose between a "Thumbs Up" or a "Heart" icon to allow post recommending.
+* Disable plugin CSS to allow you to add your own styling rules
 * Disable saving of IP address in the table.
 
-= Shortcodes =
-* You can add the voting link to any page using shortcodes
-* Now using shortcode display a specific number of most recommended posts of all time or from a specific time period with support to chose the post type.
+** Shortcodes **
+
+- Add the voting link to any page using shortcodes
+- Display specific number of most recommended posts of all time or from a specific time period with support for custom post types.
+
+= Examples of how the plugin has been used =
+
+- [Flat UI Design Gallery](http://flattrendz.com)
+- [Harish's blog](http://www.harishchouhan.com/blog/)
+- [OnePageMania.com](http://onepagemania.com/)
 
 = Translations =
 
 - English (en_US) - Harish Chouhan
 - French (fr_FR) - Murat [wptheme.fr](http://wptheme.fr/)
@@ -47,18 +53,16 @@ This plugin allows your visitors to simply like/recommend your posts instead of
 If you have created your own language pack (or have an update of an existing one) you can send in your .PO and .MO files so we can bundle it into I Recommend This plugin. You can [download the latest POT file](http://plugins.svn.wordpress.org/i-recommend-this/trunk/languages/dot-en.po), and [PO files in each language](http://plugins.svn.wordpress.org/i-recommend-this/trunk/languages/).
 
 
 This plugin is based exactly on Benoit "LeBen" Burgener's "I Like This" Plugin and has been modified after getting requests for the changes I had made on my website.
 
-Please report any bugs you find via http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/ or via WordPress forums.
-
-= Examples of how the plugin has been used =
-
-* [Flat UI Design Gallery](http://flattrendz.com) - Example usage in website Design Gallery
-* [Harish's blog](http://www.harishchouhan.com/blog/) -
-* [OnePageMania.com](http://onepagemania.com/) -
+Please report any bugs you find via  [Support Forum](https://wordpress.org/support/plugin/i-recommend-this) or via comment on http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/
 
+> ** For Developers **
+>
+> If you're a developer and want to contribute, head over to [I Recommend This plugin on GitHub](https://github.com/hchouhan/I-Recommend-This)
+>
 
 = My Links =
 
 * Twitter @[harishchouhan](https://twitter.com/harishchouhan)
 * Google+ [Harish Chouhan](https://plus.google.com/u/0/103138475844539274387/)
@@ -93,10 +97,13 @@ You can also visit the [support center](http://www.dreamsonline.net/wordpress-pl
 
 
 
 == Changelog ==
 
+= 3.7.3
+* Fixed a Possible SQL injection vulnerability reported by [Oskar Adin](https://github.com/osadi) and fixed by [Danny van Kooten](https://twitter.com/DannyvanKooten).
+
 = 3.7.2
 * Updated 'dot_irecommendthis.js' file to make plugin work even when the like button is on a hidden element. Thanks to [forthewinn](http://wordpress.org/support/profile/forthewinn). [Support Ticket](http://wordpress.org/support/topic/recommendation-to-fix-usage-in-hiddenexpanding-elements)
 
 = 3.7.1
 * Spanish translation added. Thanks to Andrew Kurtis from [WebHostingHub](http://www.webhostinghub.com/)

Vulnerable code:  * Version: 3.7.2
		    // get our variable from $atts
		    extract(shortcode_atts(array(
		        'container' => 'li',
		        'number' => '10',
		        'post_type' => 'post',
		        'year' => '',
		        'monthnum' => '',
		        'show_count' => '1',
		    ), $atts));
		    global $wpdb;
		    $request = "SELECT * FROM $wpdb->posts, $wpdb->postmeta";
		    $request .= " WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";
		    if ($year != '') {
		        $request .= " AND YEAR(post_date) = '$year'";
		    }
		    if ($monthnum != '') {
		        $request .= " AND MONTH(post_date) = '$monthnum'";
		    }
		    $request .= " AND post_status='publish' AND post_type='$post_type' AND meta_key='_recommended'";
		    $request .= " ORDER BY $wpdb->postmeta.meta_value+0 DESC LIMIT $number";
		    $posts = $wpdb->get_results($request);
		    $return = '';
		    foreach ($posts as $item) {
		        $post_title = stripslashes($item->post_title);
		        $permalink = get_permalink($item->ID);
		        $post_count = $item->meta_value;
		        $return .= '<' . $container . '>';
		        $return .= '<a href="' . $permalink . '" title="' . $post_title.'" rel="nofollow">' . $post_title . '</a> ';
		        if ( $show_count == '1') {
		            $return .= '<span class="votes">' . $post_count . '</span> ';
		        }
		        //$return .= get_the_post_thumbnail($item->ID, 'showcase-thumbnail');
		        $return .= '</' . $container . '>';
		    }
		    return $return;
	    $columns['likes'] = 'likes';
    add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);
Requires at least: 3.7
Tested up to: 3.9.1
Stable tag: 3.7.2
Last Updated: 2014-June-21

= This plugin includes =
* A counter to display the number of "like" and to vote.
* A widget and a function to display the X most liked posts.
* A preference pane with some options.
* Saves Cookie as well as users IP address to disable voting on the same post again
* Displays Number of likes on Post Edit page along with sorting option Thanks to [HSG](http://profiles.wordpress.org/HSG/)
= Advanced Options =
* Choose between a "Thumbs Up" or a "Heart" icon to allow recommending on a post
* Disable CSS to allow you to add your own styling rules
= Shortcodes =
* You can add the voting link to any page using shortcodes
* Now using shortcode display a specific number of most recommended posts of all time or from a specific time period with support to chose the post type.
Please report any bugs you find via http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/ or via WordPress forums.

= Examples of how the plugin has been used =

* [Flat UI Design Gallery](http://flattrendz.com) - Example usage in website Design Gallery
* [Harish's blog](http://www.harishchouhan.com/blog/) -
* [OnePageMania.com](http://onepagemania.com/) -
Fixed code:  * Version: 3.7.3
			// define attributes and their defaults
			// get our variable from $atts
			$atts = shortcode_atts( array(
				'container' => 'li',
				'number' => '10',
				'post_type' => 'post',
				'year' => '',
				'monthnum' => '',
				'show_count' => '1',
			), $atts );
			global $wpdb;

				// empty params array to hold params for prepared statement
				$params = array();
				// build query string
				$sql = "SELECT * FROM $wpdb->posts, $wpdb->postmeta WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";
				// add year
				if( '' !== $atts['year'] ) {
					$sql .= ' AND YEAR(post_date) = %d';
					$params[] = $atts['year'];
				}

				// add monthnum
				if( '' !== $atts['monthnum'] ) {
					$sql .= ' AND MONTH(post_date) = %d';
					$params[] = $atts['monthnum'];
				}
				// add post WHERE
				$sql .= " AND post_status = 'publish' AND post_type = %s AND meta_key = '_recommended'";
				$params[] = $atts['post_type'];
				// add order by and limit
				$sql .= " ORDER BY {$wpdb->postmeta}.meta_value+0 DESC LIMIT %d";
				$params[] = $atts['number'];
				// prepare sql statement
				$query = $wpdb->prepare( $sql, $params );
				// execute query
				$posts = $wpdb->get_results( $query );
				$return = '';
			foreach ($posts as $item) {
				$post_title = stripslashes( $item->post_title );
				$permalink = get_permalink( $item->ID );
				$post_count = $item->meta_value;
				$return .= '<' . esc_html( $atts['container'] ) . '>';
				$return .= '<a href="' . esc_url( $permalink ) . '" title="' . esc_attr( $post_title ) .'" rel="nofollow">' . esc_html( $post_title ) . '</a> ';
				if ( $atts['show_count'] == '1') {
					$return .= '<span class="votes">' . esc_html( $post_count ) . '</span> ';
				}

				$return .= '</' . esc_html( $atts['container'] ) . '>';

			}
			return $return;
		$columns['likes'] = 'likes';
	add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);
Requires at least: 4.0
Tested up to: 4.0
Stable tag: 3.7.3
Last Updated: 2014-September-24
= Features of I Recommend This =
- A counter to display the number of "like" and to vote.
- A widget and a function to display the X most liked posts.
- Saves Cookie as well as users IP address to disable voting on the same post again.
- Displays Number of likes on Post Edit page along with sorting option. [HSG](http://profiles.wordpress.org/HSG/)
- A preference pane with some options.
** Advanced Options **
* Choose between a "Thumbs Up" or a "Heart" icon to allow post recommending.
* Disable plugin CSS to allow you to add your own styling rules
** Shortcodes **

- Add the voting link to any page using shortcodes
- Display specific number of most recommended posts of all time or from a specific time period with support for custom post types.

= Examples of how the plugin has been used =

- [Flat UI Design Gallery](http://flattrendz.com)
- [Harish's blog](http://www.harishchouhan.com/blog/)
- [OnePageMania.com](http://onepagemania.com/)
Please report any bugs you find via  [Support Forum](https://wordpress.org/support/plugin/i-recommend-this) or via comment on http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/
> ** For Developers **
>
> If you're a developer and want to contribute, head over to [I Recommend This plugin on GitHub](https://github.com/hchouhan/I-Recommend-This)
>
= 3.7.3
* Fixed a Possible SQL injection vulnerability reported by [Oskar Adin](https://github.com/osadi) and fixed by [Danny van Kooten](https://twitter.com/DannyvanKooten).