WordPress WP Ultimate Exporter 1.0 / 1.1 SQL Injection

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
After reading bugtraq post[1] I noticed additional vulnerability from WordPress  
plugin wp-ultimate-exporter[2]. Versions 1.0 and 1.1 are affected of SQL  
injection vulnerability without authentication.  
  
1: http://seclists.org/bugtraq/2016/Feb/172  
2: https://wordpress.org/plugins/wp-ultimate-exporter/  
  
Parameter: MULTIPART export_type_name ((custom) POST)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)  
  
"""  
POST /wp-admin/admin.php?page=wp_ultimate_exporter&step=exportposttype HTTP/1.1  
Host: example.com  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.6.1  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Connection: close  
Content-Type: multipart/form-data; boundary=---------------------------110342333716197608971909825185  
Content-Length: 1452  
  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="export_type_name"  
  
post  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="export_custompost_type"  
  
- --Select--  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="get_data_with_delimiter"  
  
get_data_with_delimiter  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="post_withdelimiter"  
  
,  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="othersdelimiter"  
  
  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="postdatefrom"  
  
  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="postdateto"  
  
  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="postwithstatus"  
  
All  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="postauthor"  
  
0  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="export_filename"  
  
  
- -----------------------------110342333716197608971909825185  
Content-Disposition: form-data; name="proceed_to_exclusion"  
  
Export  
- -----------------------------110342333716197608971909825185--  
"""  
  
includes/UltimateExportHelper.php:  
43 public function createCSVHeaders($exportposttype){  
44 global $wpdb;  
45 $Header = array();  
46 $post_type = $exportposttype;  
47   
48 $header_query1 = "SELECT wp.* FROM $wpdb->posts wp where post_type = '$post_type'";  
49 $header_query2 = "SELECT post_id, meta_key, meta_value FROM $wpdb->posts wp JOIN $wpdb->postmeta wpm ON wpm.post_id = wp.ID where wp.post_type = '$post_type' and meta_key NOT IN ('_edit_lock','_edit_last') and meta_key NOT LIKE 'field_%' and meta_key NOT L IKE '_wp_types%'";  
50 $result_header_query1 = $wpdb->get_results($header_query1);  
  
- --   
Henri Salo  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1  
  
iQIcBAEBAgAGBQJWz1ooAAoJECet96ROqnV0tLIQANVToxM64sTlBwomPwE7cdi7  
WNCGny3saZigdADSeDcmfxtHm9OJHoWWRXOoqRj5RcOCTeie15xg/xX35rn55CSq  
MWk8RXad/mFJVCXa0eldahetQV2qN5JScg05ajxyqeTJ3PDOUztBUt0WuD9gyyQH  
PiIYWqHYBWd/OIvHBELHwsoV8Oe8jNVQlyipSH/b4/ny11ilw+P/MjrltZQDUlHU  
88HNGkS3A66RR9w2uOUzTAi37Gj3/1J4JeQGFwZQUOxcGaP9WhMhF+PkT4fVMKrY  
qnRz4rsSrZ9GO7Ilv3DMa8qJdHC2zdFuodQIaFCD5tsntCvIAIcHgBynhptqkXAI  
KjrVxmjc/HXQo9Jh0yO5Dkym+kexNJeNUOoWy2VBPFgDXdiYM6CaQJGNlm/CiuYa  
9YEqrn4G9Oan5WLNxD8vsItNF3J3zZQSJ3kArLJdXrhzXfgYpwz7nCvHGZAgFBqJ  
K63Sc1pkUnzcEV6XU/Hc8CSfQwlTLsjPibUJg8XxGeHwcrVA04YBQMufMfPxPfLU  
PyQ1VWTagTGxwPrsMuJy/z24bvSv3fJmk705Jr0itSKfqqYtu703q6ZPyhRhEOVd  
eIBLG5jBdHmoZrHHM7BIn5ojx5BJtwNk74Buj9mBh4lhj6FwyCg7/hUic6cUk6Q5  
0FNGYMPPcDbIpt61okEL  
=/0/D  
-----END PGP SIGNATURE-----  
`