# Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 a WordPress Plugin a Sql Injection # Exploit Author: Lenon Leite # Vendor Homepage: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/ # Software Link: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/ # Contact: http://twitter.com/lenonleite # Website: http://lenonleite.com.br/ # Category: webapps # Version: 7.1.3 # Tested on: Ubuntu 14.04 1 - Description: Type user access: any user. $_POST[acat_ida] is not escaped. Is accessible for any user. http://lenonleite.com.br/en/blog/2016/12/13/wp-support-plus-responsive-ticket-system-wordpress-plugin-sql-injection/ 2 - Proof of Concept:
3 - Timeline: - 12/12/2016 a Discovered - 13/12/2016 a Vendor notifed - 16/12/2016 a Resolve issue version 7.1.5