.. / CVE-2019-10692

Exploit for WordPress Google Maps <7.11.18 - SQL Injection (CVE-2019-10692)

Description:

WordPress Google Maps plugin before 7.11.18 contains a SQL injection vulnerability. The plugin includes /class.rest-api.php in the REST API and does not sanitize field names before a SELECT statement. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

Nuclei Template

View the template here CVE-2019-10692.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-10692.yaml
Copy

References:

https://wordpress.org/plugins/wp-google-maps/#developers
https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-google-maps&old=2061433&new_path=%2Fwp-google-maps&new=2061434&sfp_email=&sfph_mail=#file755
https://github.com/VTFoundation/vulnerablewp
https://nvd.nist.gov/vuln/detail/CVE-2019-10692
https://wpscan.com/vulnerability/475404ce-2a1a-4d15-bf02-df0ea2afdaea