WordPress Tierra Billboard Manager 1.14 SQL Injection

`############################################################################################################  
# Exploit Title : Wordpress Plugin Tierra Billboard Manager SQL Injection Vulnerability  
# Exploit Author : Linux Zone Research Team  
# Date : 14-December-2015  
# Vendor Homepage: https://wordpress.org  
# Software Link : https://wordpress.org/plugins/tierra-billboard-manager/  
# Version : 1.14  
# Tested on : Linux - Chrome  
# CVE : NONE  
# MY HOME : http://linux-zone.org  
############################################################################################################  
#  
# Location : /wp-content/plugins/tierra-billboard-manager/tierra-billboard-playlist.php?id=[SQL]  
#  
############################################################################################################  
<?php  
header("Content-Type: text/html");  
/*  
if (isset($_GET['preview']) && $_GET['preview'] == 'true' ) {  
header("Content-Type: application/xml;charset=utf-8");  
} else {  
header("Content-Type: application/xspf+xml;charset=utf-8");  
  
}  
*/  
  
  
require_once('../../../wp-config.php');  
require_once('../../../wp-settings.php');  
  
global $wpdb, $_billboard_manager_db_version, $_billboard_manager, $baseurl, $pluginurl;  
  
$_billboard_manager = $wpdb->prefix . "ti_billboard_manager";  
  
$playlist_id = intval($_GET['id']);  
  
$media_id = isset($_GET['media_id']) ? intval($_GET['media_id']) : -1;  
  
$baseurl = $_SERVER["QUERY_STRING"];  
  
$pluginURL = WP_PLUGIN_URL;  
  
if ($media_id <= 0) {  
  
$sql = 'select title, image, tracks, creation_date, license from ' . $_billboard_manager . ' where id = ' . $wpdb->escape($playlist_id);  
  
} else {  
  
$sql = 'select id, post_title as title, "' . $media_id . '" as tracks, post_date as creation_date from ' . $wpdb->posts . ' where id = ' . $media_id;   
  
}  
  
$row = $wpdb->get_row($sql);  
  
$license = $row->license ? htmlentities($row->license) : '';  
  
$title = htmlentities(stripslashes($row->title));  
$tracks = split (',' , $row->tracks);  
$i = 0;  
  
  
echo<<<__END_OF_HEADER__  
<?xml version="1.0" encoding="UTF-8"?>  
<playlist version="1" xmlns = "http://xspf.org/ns/0/">  
<title>$title</title>  
<creator>Tierra Billboard Manager</creator>  
<annotation>Playlist generated via Tierra Billboard Manager, part of the Tierra WordPress CMS Toolkit</annotation>  
<info>http://tierra-innovation.com/wordpress-cms/</info>  
<image>$pluginURL/tierra-billboard-manager/skin/brand.png</image>  
<license>$license</license>  
<date>$row->creation_date</date>  
<trackList>  
__END_OF_HEADER__  
;  
  
$wpuploads = wp_upload_dir();  
  
if ($row->tracks) {  
foreach ($tracks as $track) {   
$sql = 'select id, post_title as track, guid, post_date, post_excerpt, post_modified from ' . $wpdb->posts . ' where id = ' . $track;  
  
$row = $wpdb->get_row($sql);  
  
if ($row) {  
$metadata = get_post_meta($row->id, '_wp_attachment_metadata', true);  
  
  
if ( ( $row->id = intval($row->id) ) && $thumb_url = get_attachment_icon_src( $row->id ) )  
$thumb_url = htmlspecialchars($thumb_url[0]);  
else {  
$wpuploads = wp_upload_dir();  
if ($metadata['file']) {  
$path_parts = pathinfo($metadata['file']);  
$datepath = $wpuploads['baseurl'] . "/" .$path_parts['dirname'];  
}  
$thumb_url = htmlspecialchars($metadata['sizes']['thumbnail']['file']  
? ($datepath . '/' . stripslashes($metadata['sizes']['thumbnail']['file']) )  
: "/wp-includes/images/crystal/interactive.png");  
}  
  
  
  
print "  
<track>  
<location>" . ( $row->guid ? htmlspecialchars($row->guid) : ( $wpuploads['baseurl'] . '/' . $metadata['file'] ))."</location>  
  
<creator>" .( $metadata['_ti_bbm_artist'] ? htmlspecialchars($metadata['_ti_bbm_artist']) : "" )."</creator>  
<album>" . ( $metadata['_ti_bbm_album'] ? htmlspecialchars($metadata['_ti_bbm_album']) : "" ). "</album>  
<image>$thumb_url</image>  
<title>" . ( $row->track ? htmlspecialchars($row->track) : "No title" ) . "</title>  
<annotation>Type:" .$wpdb->escape($row->post_mime_type) .";</annotation>  
<info>" . $wpdb->escape($metadata['_ti_bbm_linkTo']) ."</info>  
<trackNum>" . $wpdb->escape($metadata['_ti_bbm_tracknum']) ."</trackNum>  
<duration>" . $wpdb->escape($metadata['_ti_bbm_duration']) ."</duration>  
<meta><description>" . htmlspecialchars(stripslashes($row->post_excerpt)) . "</description></meta>  
  
</track>  
";   
}  
}  
}  
  
  
  
print<<<__END_OF_XML__  
  
</trackList>  
</playlist>   
  
  
__END_OF_XML__  
;  
  
?>  
#############################################  
#  
# Hassan Shakeri - Mohammad Habili  
#  
# Twitter : @ShakeriHassan - Fb.com/General.BlackHat  
##########################################################  
`