Database query injection via unsanitized post_type

SQL injection in AyeCode Ltd GeoDirectory before 2.2.24 allows remote authenticated users with administrator access to alter database queries. The geodir_delete_dummy_data AJAX action places the attacker-controlled post_type parameter into a SQL statement without adequate sanitization or escaping, allowing appended SQL clauses and time-delay subqueries. A valid WordPress administrator session and action nonce are required; the published proof of concept demonstrates a five-second database delay, while broader query control is bounded by the WordPress database account's permissions.