CVE-2019-10692

Опубликовано: 02 апр. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.

Ссылки

http://packetstormsecurity.com/files/159640/WordPress-Rest-Google-Maps-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://www.rapid7.com/db/modules/auxiliary/admin/http/wp_google_maps_sqli
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-google-maps&old=2061433&new_path=%2Fwp-google-maps&new=2061434&sfp_email=&sfph_mail=#file755
Patch
Third Party Advisory
https://wordpress.org/plugins/wp-google-maps/#developers
Third Party Advisory
http://packetstormsecurity.com/files/159640/WordPress-Rest-Google-Maps-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://www.rapid7.com/db/modules/auxiliary/admin/http/wp_google_maps_sqli
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-google-maps&old=2061433&new_path=%2Fwp-google-maps&new=2061434&sfp_email=&sfph_mail=#file755
Patch
Third Party Advisory
https://wordpress.org/plugins/wp-google-maps/#developers
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:*:wordpress:*:*

Версия до 7.11.18 (исключая)

EPSS

Процентиль: 100%

0.89285

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-ff7x-cjfp-39rh