Dispute Taggator Plugin for WordPress taggator.php tagid Parameter SQL Injection

[Henri Salo <henri () nerv fi>]

Hello Amir,

You originally reported a SQL injection security vulnerability in taggator-plugin in bugtraq[1], which can also be 
found from [2] and [3]. Vendor URL is [4] (from SVN [5]). I found from vendor page a note about your advisory:

"""
(6-4-2012) Notice 

There has been some reports of an SQL injection vulnerability in TagGator, I would like to reassure all users that we 
have checked the published exploit and confirmed that it was not valid.

The Exploit says that the get parameter tagid can be used to execute sql on a website. TagGator doesn’t have this GET 
parameter, in fact, it doesn’t have any GET parameters, and even if it did, trying to execute the plugin directly 
outside of wordpress will result in error at the first line of code as all wordpress functions are inaccessible.

No code is completely immune to hacking, TagGator is not an exception, but at least not with this exploit. As any 
developer, I am doing my best to keep my work safe and useful to my users. If you would find any security risks in my 
work, please report to me through the contact us page.
"""

There has been only one commit in trunk after your advisory, which is copypasted in pastebin [6]. Could you verify that 
the advisory is correct? Please tell me which versions are affected if any, thank you.

1: http://seclists.org/bugtraq/2012/Apr/43
2: http://osvdb.org/show/osvdb/80965
3: http://packetstormsecurity.org/files/111621/WordPress-Taggator-SQL-Injection.html
4: http://angrybyte.com/wordpress-plugins/taggator/
5: http://plugins.svn.wordpress.org/taggator/trunk/
6: http://paste.nerv.fi/94105745.txt

- Henri Salo