WordPress Users Ultra Plugin 1.5.50 - Blind SQL 注入

在users-ultra插件的xooclasses/xoo.userultra.photos.php文件中有如下代码： public function editvideoconfirm global $wpdb, $xoouserultra; requireonceABSPATH . 'wp-includes/formatting.php'; $userid = getcurrentuserid; $videoid = $POST"videoid"; //videoid 直接从POST取值 $videoname = sanitizetextfield$POST"videoname";...