by Kastro
Paper/Archive/CVE-2023-0037

CVE-2023-0037

Unknown 10Web Map Builder for Google Maps — 10WebMapBuilder < 1.0.73 - Unauthenticated SQLi

EPSS 4%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.3.903 × 2018.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Affected

ProductAffectedFixed inSource
10Web Map Builder for Google Maps< 1.0.731.0.73CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56refbulletin.iese.de/post/wd-google-maps_1-0-72_1