CVE-2014-125099 (Other, published 2023-04-20T06:15Z)
Description: value: A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/wp-plugins/i-recommend-this
Files changed:
dot-irecommendthis.php
readme.txt
Commit message: Fixed a Possible SQL injection vulnerability reported by [Oskar Adin](https://github.com/osadi) and fixed by [Danny van Kooten](https://twitter.com/DannyvanKooten).

git-svn-id: https://plugins.svn.wordpress.org/i-recommend-this/trunk@996218 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
 * Version: 3.7.2
		    // get our variable from $atts
		    extract(shortcode_atts(array(
		        'container' => 'li',
		        'number' => '10',
		        'post_type' => 'post',
		        'year' => '',
		        'monthnum' => '',
		        'show_count' => '1',
		    ), $atts));
		    global $wpdb;
		    $request = "SELECT * FROM $wpdb->posts, $wpdb->postmeta";
		    $request .= " WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";
		    if ($year != '') {
		        $request .= " AND YEAR(post_date) = '$year'";
		    }
		    if ($monthnum != '') {
		        $request .= " AND MONTH(post_date) = '$monthnum'";
		    }
		    $request .= " AND post_status='publish' AND post_type='$post_type' AND meta_key='_recommended'";
		    $request .= " ORDER BY $wpdb->postmeta.meta_value+0 DESC LIMIT $number";
		    $posts = $wpdb->get_results($request);
		    $return = '';
		    foreach ($posts as $item) {
		        $post_title = stripslashes($item->post_title);
		        $permalink = get_permalink($item->ID);
		        $post_count = $item->meta_value;
		        $return .= '<' . $container . '>';
		        $return .= '<a href="' . $permalink . '" title="' . $post_title.'" rel="nofollow">' . $post_title . '</a> ';
		        if ( $show_count == '1') {
		            $return .= '<span class="votes">' . $post_count . '</span> ';
		        }
		        //$return .= get_the_post_thumbnail($item->ID, 'showcase-thumbnail');
		        $return .= '</' . $container . '>';
		    }
		    return $return;
	    $columns['likes'] = 'likes';
    add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);
Requires at least: 3.7
Tested up to: 3.9.1
Stable tag: 3.7.2
Last Updated: 2014-June-21

= This plugin includes =
* A counter to display the number of "like" and to vote.
* A widget and a function to display the X most liked posts.
* A preference pane with some options.
* Saves Cookie as well as users IP address to disable voting on the same post again
* Displays Number of likes on Post Edit page along with sorting option Thanks to [HSG](http://profiles.wordpress.org/HSG/)
= Advanced Options =
* Choose between a "Thumbs Up" or a "Heart" icon to allow recommending on a post
* Disable CSS to allow you to add your own styling rules
= Shortcodes =
* You can add the voting link to any page using shortcodes
* Now using shortcode display a specific number of most recommended posts of all time or from a specific time period with support to chose the post type.
Please report any bugs you find via http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/ or via WordPress forums.

= Examples of how the plugin has been used =

* [Flat UI Design Gallery](http://flattrendz.com) - Example usage in website Design Gallery
* [Harish's blog](http://www.harishchouhan.com/blog/) -
* [OnePageMania.com](http://onepagemania.com/) -

Fixed code:
 * Version: 3.7.3
			// define attributes and their defaults
			// get our variable from $atts
			$atts = shortcode_atts( array(
				'container' => 'li',
				'number' => '10',
				'post_type' => 'post',
				'year' => '',
				'monthnum' => '',
				'show_count' => '1',
			), $atts );
			global $wpdb;

				// empty params array to hold params for prepared statement
				$params = array();
				// build query string
				$sql = "SELECT * FROM $wpdb->posts, $wpdb->postmeta WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";
				// add year
				if( '' !== $atts['year'] ) {
					$sql .= ' AND YEAR(post_date) = %d';
					$params[] = $atts['year'];
				}

				// add monthnum
				if( '' !== $atts['monthnum'] ) {
					$sql .= ' AND MONTH(post_date) = %d';
					$params[] = $atts['monthnum'];
				}
				// add post WHERE
				$sql .= " AND post_status = 'publish' AND post_type = %s AND meta_key = '_recommended'";
				$params[] = $atts['post_type'];
				// add order by and limit
				$sql .= " ORDER BY {$wpdb->postmeta}.meta_value+0 DESC LIMIT %d";
				$params[] = $atts['number'];
				// prepare sql statement
				$query = $wpdb->prepare( $sql, $params );
				// execute query
				$posts = $wpdb->get_results( $query );
				$return = '';
			foreach ($posts as $item) {
				$post_title = stripslashes( $item->post_title );
				$permalink = get_permalink( $item->ID );
				$post_count = $item->meta_value;
				$return .= '<' . esc_html( $atts['container'] ) . '>';
				$return .= '<a href="' . esc_url( $permalink ) . '" title="' . esc_attr( $post_title ) .'" rel="nofollow">' . esc_html( $post_title ) . '</a> ';
				if ( $atts['show_count'] == '1') {
					$return .= '<span class="votes">' . esc_html( $post_count ) . '</span> ';
				}

				$return .= '</' . esc_html( $atts['container'] ) . '>';

			}
			return $return;
		$columns['likes'] = 'likes';
	add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);
Requires at least: 4.0
Tested up to: 4.0
Stable tag: 3.7.3
Last Updated: 2014-September-24
= Features of I Recommend This =
- A counter to display the number of "like" and to vote.
- A widget and a function to display the X most liked posts.
- Saves Cookie as well as users IP address to disable voting on the same post again.
- Displays Number of likes on Post Edit page along with sorting option. [HSG](http://profiles.wordpress.org/HSG/)
- A preference pane with some options.
** Advanced Options **
* Choose between a "Thumbs Up" or a "Heart" icon to allow post recommending.
* Disable plugin CSS to allow you to add your own styling rules
** Shortcodes **

- Add the voting link to any page using shortcodes
- Display specific number of most recommended posts of all time or from a specific time period with support for custom post types.

= Examples of how the plugin has been used =

- [Flat UI Design Gallery](http://flattrendz.com)
- [Harish's blog](http://www.harishchouhan.com/blog/)
- [OnePageMania.com](http://onepagemania.com/)
Please report any bugs you find via  [Support Forum](https://wordpress.org/support/plugin/i-recommend-this) or via comment on http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/
> ** For Developers **
>
> If you're a developer and want to contribute, head over to [I Recommend This plugin on GitHub](https://github.com/hchouhan/I-Recommend-This)
>
= 3.7.3
* Fixed a Possible SQL injection vulnerability reported by [Oskar Adin](https://github.com/osadi) and fixed by [Danny van Kooten](https://twitter.com/DannyvanKooten).