CVE-2014-125099 (published 2023-04-20T06:15Z)

A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/wp-plugins/i-recommend-this
commit_details: repo_url: https://github.com/wp-plugins/i-recommend-this
author: hchouhan
author_date: 2014-09-24 17:35:03+00:00
msg: Fixed a Possible SQL injection vulnerability reported by [Oskar Adin](https://github.com/osadi) and fixed by [Danny van Kooten](https://twitter.com/DannyvanKooten).

git-svn-id: https://plugins.svn.wordpress.org/i-recommend-this/trunk@996218 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/i-recommend-this
repo_name: wp-plugins/i-recommend-this
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: dot-irecommendthis.php
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
  * Plugin Name: I Recommend This
  * Plugin URI: http://www.harishchouhan.com/personal-projects/i-recommend-this/
  * Description: This plugin allows your visitors to simply recommend or like your posts instead of commment it.
- * Version: 3.7.2
+ * Version: 3.7.3
  * Author: Harish Chouhan
  * Author URI: http://www.harishchouhan.com
  * Author Email: me@harishchouhan.com
@@ -671,53 +671,70 @@ if ( ! class_exists( 'DOT_IRecommendThis' ) )
 
 		function dot_recommended_top_posts( $atts, $content = null )
 		{
-		    // get our variable from $atts
-		    extract(shortcode_atts(array(
-		        'container' => 'li',
-		        'number' => '10',
-		        'post_type' => 'post',
-		        'year' => '',
-		        'monthnum' => '',
-		        'show_count' => '1',
-		    ), $atts));
 
-		    global $wpdb;
+			// define attributes and their defaults
+			// get our variable from $atts
+			$atts = shortcode_atts( array(
+				'container' => 'li',
+				'number' => '10',
+				'post_type' => 'post',
+				'year' => '',
+				'monthnum' => '',
+				'show_count' => '1',
+			), $atts );
 
-		    $request = "SELECT * FROM $wpdb->posts, $wpdb->postmeta";
-		    $request .= " WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";
+			global $wpdb;
+
+				// empty params array to hold params for prepared statement
+				$params = array();
 
-		    if ($year != '') {
-		        $request .= " AND YEAR(post_date) = '$year'";
-		    }
+				// build query string
+				$sql = "SELECT * FROM $wpdb->posts, $wpdb->postmeta WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";
 
-		    if ($monthnum != '') {
-		        $request .= " AND MONTH(post_date) = '$monthnum'";
-		    }
+				// add year
+				if( '' !== $atts['year'] ) {
+					$sql .= ' AND YEAR(post_date) = %d';
+					$params[] = $atts['year'];
+				}
+
+				// add monthnum
+				if( '' !== $atts['monthnum'] ) {
+					$sql .= ' AND MONTH(post_date) = %d';
+					$params[] = $atts['monthnum'];
+				}
 
-		    $request .= " AND post_status='publish' AND post_type='$post_type' AND meta_key='_recommended'";
-		    $request .= " ORDER BY $wpdb->postmeta.meta_value+0 DESC LIMIT $number";
-		    $posts = $wpdb->get_results($request);
+				// add post WHERE
+				$sql .= " AND post_status = 'publish' AND post_type = %s AND meta_key = '_recommended'";
+				$params[] = $atts['post_type'];
 
-		    $return = '';
+				// add order by and limit
+				$sql .= " ORDER BY {$wpdb->postmeta}.meta_value+0 DESC LIMIT %d";
+				$params[] = $atts['number'];
 
+				// prepare sql statement
+				$query = $wpdb->prepare( $sql, $params );
 
-		    foreach ($posts as $item) {
-		        $post_title = stripslashes($item->post_title);
-		        $permalink = get_permalink($item->ID);
-		        $post_count = $item->meta_value;
+				// execute query
+				$posts = $wpdb->get_results( $query );
 
-		        $return .= '<' . $container . '>';
-		        $return .= '<a href="' . $permalink . '" title="' . $post_title.'" rel="nofollow">' . $post_title . '</a> ';
+				$return = '';
 
-		        if ( $show_count == '1') {
-		            $return .= '<span class="votes">' . $post_count . '</span> ';
-		        }
+			foreach ($posts as $item) {
+				$post_title = stripslashes( $item->post_title );
+				$permalink = get_permalink( $item->ID );
+				$post_count = $item->meta_value;
 
-		        //$return .= get_the_post_thumbnail($item->ID, 'showcase-thumbnail');
-		        $return .= '</' . $container . '>';
+				$return .= '<' . esc_html( $atts['container'] ) . '>';
+				$return .= '<a href="' . esc_url( $permalink ) . '" title="' . esc_attr( $post_title ) .'" rel="nofollow">' . esc_html( $post_title ) . '</a> ';
 
-		    }
-		    return $return;
+				if ( $atts['show_count'] == '1') {
+					$return .= '<span class="votes">' . esc_html( $post_count ) . '</span> ';
+				}
+
+				$return .= '</' . esc_html( $atts['container'] ) . '>';
+
+			}
+			return $return;
 
 		}	//dot_recommended_top_posts
 
@@ -866,7 +883,7 @@ if ( ! class_exists( 'DOT_IRecommendThis' ) )
 	}
 
 	function dot_column_register_sortable( $columns ) {
-	    $columns['likes'] = 'likes';
+		$columns['likes'] = 'likes';
 		return $columns;
 	}
 
@@ -883,6 +900,6 @@ if ( ! class_exists( 'DOT_IRecommendThis' ) )
 	add_filter('request', 'dot_column_orderby');
 	add_filter('manage_edit-post_sortable_columns', 'dot_column_register_sortable');
 	add_filter('manage_posts_columns', 'dot_columns_head');
-    add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);
+	add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);
 
 ?>
\ No newline at end of file

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -2,39 +2,45 @@
 Contributors: hchouhan, themeist, dreamsmedia, Benoit "LeBen" Burgener
 Donate link: http://themeist.co
 Tags: recommend, like, love, post, rate, rating, post rating, heart, dribbble like, tumblr like
-Requires at least: 3.7
-Tested up to: 3.9.1
-Stable tag: 3.7.2
-Last Updated: 2014-June-21
+Requires at least: 4.0
+Tested up to: 4.0
+Stable tag: 3.7.3
+Last Updated: 2014-September-24
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 This plugin allows your visitors to simply like/recommend your posts instead of comment on it.
 
-
 == Description ==
 
 This plugin allows your visitors to simply like/recommend your posts instead of comment on it.
 
+= Features of I Recommend This =
 
-= This plugin includes =
-* A counter to display the number of "like" and to vote.
-* A widget and a function to display the X most liked posts.
-* A preference pane with some options.
-* Saves Cookie as well as users IP address to disable voting on the same post again
-* Displays Number of likes on Post Edit page along with sorting option Thanks to [HSG](http://profiles.wordpress.org/HSG/)
+- A counter to display the number of "like" and to vote.
+- A widget and a function to display the X most liked posts.
+- Saves Cookie as well as users IP address to disable voting on the same post again.
+- Displays Number of likes on Post Edit page along with sorting option. [HSG](http://profiles.wordpress.org/HSG/)
+- A preference pane with some options.
 
+** Advanced Options **
 
-= Advanced Options =
 * Hide count if count is zero
 * Set a default messages when count is zero, one or more
-* Choose between a "Thumbs Up" or a "Heart" icon to allow recommending on a post
-* Disable CSS to allow you to add your own styling rules
+* Choose between a "Thumbs Up" or a "Heart" icon to allow post recommending.
+* Disable plugin CSS to allow you to add your own styling rules
 * Disable saving of IP address in the table.
 
-= Shortcodes =
-* You can add the voting link to any page using shortcodes
-* Now using shortcode display a specific number of most recommended posts of all time or from a specific time period with support to chose the post type.
+** Shortcodes **
+
+- Add the voting link to any page using shortcodes
+- Display specific number of most recommended posts of all time or from a specific time period with support for custom post types.
+
+= Examples of how the plugin has been used =
+
+- [Flat UI Design Gallery](http://flattrendz.com)
+- [Harish's blog](http://www.harishchouhan.com/blog/)
+- [OnePageMania.com](http://onepagemania.com/)
 
 = Translations =
 
@@ -49,14 +55,12 @@ If you have created your own language pack (or have an update of an existing one
 
 This plugin is based exactly on Benoit "LeBen" Burgener's "I Like This" Plugin and has been modified after getting requests for the changes I had made on my website.
 
-Please report any bugs you find via http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/ or via WordPress forums.
-
-= Examples of how the plugin has been used =
-
-* [Flat UI Design Gallery](http://flattrendz.com) - Example usage in website Design Gallery
-* [Harish's blog](http://www.harishchouhan.com/blog/) -
-* [OnePageMania.com](http://onepagemania.com/) -
+Please report any bugs you find via  [Support Forum](https://wordpress.org/support/plugin/i-recommend-this) or via comment on http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/
 
+> ** For Developers **
+>
+> If you're a developer and want to contribute, head over to [I Recommend This plugin on GitHub](https://github.com/hchouhan/I-Recommend-This)
+>
 
 = My Links =
 
@@ -95,6 +99,9 @@ You can also visit the [support center](http://www.dreamsonline.net/wordpress-pl
 
 == Changelog ==
 
+= 3.7.3
+* Fixed a Possible SQL injection vulnerability reported by [Oskar Adin](https://github.com/osadi) and fixed by [Danny van Kooten](https://twitter.com/DannyvanKooten).
+
 = 3.7.2
 * Updated 'dot_irecommendthis.js' file to make plugin work even when the like button is on a hidden element. Thanks to [forthewinn](http://wordpress.org/support/profile/forthewinn). [Support Ticket](http://wordpress.org/support/topic/recommendation-to-fix-usage-in-hiddenexpanding-elements)
 

programming_language: Markdown