Active Directory Integration <= 1.1.8 - Authenticated SQL Injection

Description

Type user acces: administrator user.
Target need have configured ldap and active.

Path Request: /wp-content/plugins/active-directory-integration/syncback.php

Line : 135
$result = $ADI->bulksyncback( $_GET['userid'] );

$_GET[‘userid’] is not escaped.

Path Method: /wp-content/plugins/active-directory-integration/BulkSyncBackADIntegrationPlugin.class.php

Line: 142
$wpdb->get_results("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = 'adi_samaccountname' AND meta_value <> '' AND user_id <> 1 AND user_id = $userid");