Description
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | 10Web Map Builder for Google Maps | < 1.0.73 | 1.0.73 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection http/cves/2023/CVE-2023-0037.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56 exploit vdb-entry technical-description
- https://bulletin.iese.de/post/wd-google-maps_1-0-72_1