Charlie Eriksen has discovered two vulnerabilities in the Flexi Quote Rotator plugin for WordPress, which can be exploited by malicious users to conduct SQL injection attacks and by malicious people to conduct cross-site request forgery attacks.

1) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. add and edit quotes when a logged-in user with e.g. "Editor" access rights visits a specially crafted web page.

2) Input passed via the "id" parameter to wordpress/wp-admin/tools.php (when "page" is set to "flexi-quote-rotator.php" and "action" is set to "edit") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability requires access rights to edit quotes (e.g. "Editor" access rights).

The vulnerabilities are confirmed in version 0.9. Prior versions may also be affected.

Solution
Update to version 0.9.2.

Provided and/or discovered by
Charlie Eriksen via Secunia.

Changelog
Further details available to Secunia VIM customers

Original Advisory
WordPress Flexi Quote Rotator Plugin:
http://wordpress.org/extend/plugins/flexi-quote-rotator/changelog/
http://plugins.trac.wordpress.org/changeset/575843/flexi-quote-rotator
http://plugins.trac.wordpress.org/changeset/575834/flexi-quote-rotator

Charlie Eriksen:
http://ceriksen.com/Advisories/16

Deep Links
Links available to Secunia VIM customers