bulletin.iese.de
https://bulletin.iese.de/post/wd-google-maps_1-0-72_1 CVE-2023-0037
CRITICALNuclei
10WebMapBuilder < 1.0.73 - Unauthenticated SQLi
Record summary
CVE-2023-0037 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.
Description
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Mar 3, 2023 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 27, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
map_builder_for_google_mapsBrowse 10web / map_builder_for_google_maps | VulnCheck | Version data not supplied | |
10Web Map Builder for Google MapsDefault status: unaffected | CVE List | Before 1.0.73 | affected |
Nuclei templates
1ProjectDiscoveryCRITICALWordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL InjectionCVSS 9.8
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Impact
Unauthenticated attackers can execute SQL injection through AJAX actions to extract the complete WordPress database including user credentials, map configuration data, and sensitive site information.
Remediation
Fixed in 1.0.73
WeaknessesCWE-89
Authorsriteshs4hu
Template tagswpscancvecve2023wordpresswp-pluginwpwd-google-mapssqlitime-basedvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:10web:map_builder_for_google_maps:*:*:*:*:*:wordpress:*:*
https://nvd.nist.gov/vuln/detail/CVE-2023-0037 https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56/ https://bulletin.iese.de/post/wd-google-maps_1-0-72_1
Source: ProjectDiscovery
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-0037 wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56