cvelistv5 - cve-2023-0037

CVE-2023-0037 (GCVE-0-2023-0037)

Vulnerability from cvelistv5 – Published: 2023-03-13 16:03 – Updated: 2025-02-27 20:19

Summary

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 SQL Injection

Assigner

WPScan

References

URL

Tags

	https://wpscan.com/vulnerability/33ab1fe2-6611-4f…	exploitvdb-entrytechnical-description
	https://bulletin.iese.de/post/wd-google-maps_1-0-72_1

Impacted products

	Vendor	Product	Version
	Unknown	10Web Map Builder for Google Maps	Affected: 0 , < 1.0.73 (custom)

Credits

Daniel Krohmer (Fraunhofer IESE) Kunal Sharma (University of Kaiserslautern) WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:32.578Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bulletin.iese.de/post/wd-google-maps_1-0-72_1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-0037",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T20:18:59.817232Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T20:19:24.314Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "10Web Map Builder for Google Maps",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.0.73",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daniel Krohmer (Fraunhofer IESE)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Kunal Sharma (University of Kaiserslautern)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-13T16:03:32.276Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56"
        },
        {
          "url": "https://bulletin.iese.de/post/wd-google-maps_1-0-72_1"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "10WebMapBuilder \u003c 1.0.73 - Unauthenticated SQLi",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2023-0037",
    "datePublished": "2023-03-13T16:03:32.276Z",
    "dateReserved": "2023-01-03T13:33:27.282Z",
    "dateUpdated": "2025-02-27T20:19:24.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:10web:map_builder_for_google_maps:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.0.73\", \"matchCriteriaId\": \"9842C196-76F8-4A79-B68C-43DE9DB76E6A\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\"}]",
      "id": "CVE-2023-0037",
      "lastModified": "2024-11-21T07:36:26.377",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2023-03-13T17:15:12.087",
      "references": "[{\"url\": \"https://bulletin.iese.de/post/wd-google-maps_1-0-72_1\", \"source\": \"contact@wpscan.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56\", \"source\": \"contact@wpscan.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://bulletin.iese.de/post/wd-google-maps_1-0-72_1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "contact@wpscan.com",
      "vulnStatus": "Modified"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-0037\",\"sourceIdentifier\":\"contact@wpscan.com\",\"published\":\"2023-03-13T17:15:12.087\",\"lastModified\":\"2025-02-27T21:15:16.470\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:10web:map_builder_for_google_maps:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.0.73\",\"matchCriteriaId\":\"9842C196-76F8-4A79-B68C-43DE9DB76E6A\"}]}]}],\"references\":[{\"url\":\"https://bulletin.iese.de/post/wd-google-maps_1-0-72_1\",\"source\":\"contact@wpscan.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56\",\"source\":\"contact@wpscan.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://bulletin.iese.de/post/wd-google-maps_1-0-72_1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81\", \"shortName\": \"WPScan\", \"dateUpdated\": \"2023-03-13T16:03:32.276Z\"}, \"title\": \"10WebMapBuilder \u003c 1.0.73 - Unauthenticated SQLi\", \"problemTypes\": [{\"descriptions\": [{\"description\": \"CWE-89 SQL Injection\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"affected\": [{\"vendor\": \"Unknown\", \"product\": \"10Web Map Builder for Google Maps\", \"versions\": [{\"status\": \"affected\", \"versionType\": \"custom\", \"version\": \"0\", \"lessThan\": \"1.0.73\"}], \"defaultStatus\": \"unaffected\", \"collectionURL\": \"https://wordpress.org/plugins\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\"}], \"references\": [{\"url\": \"https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56\", \"tags\": [\"exploit\", \"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://bulletin.iese.de/post/wd-google-maps_1-0-72_1\"}], \"credits\": [{\"lang\": \"en\", \"value\": \"Daniel Krohmer (Fraunhofer IESE)\", \"type\": \"finder\"}, {\"lang\": \"en\", \"value\": \"Kunal Sharma (University of Kaiserslautern)\", \"type\": \"finder\"}, {\"lang\": \"en\", \"value\": \"WPScan\", \"type\": \"coordinator\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"x_generator\": {\"engine\": \"WPScan CVE Generator\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:54:32.578Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56\", \"tags\": [\"exploit\", \"vdb-entry\", \"technical-description\", \"x_transferred\"]}, {\"url\": \"https://bulletin.iese.de/post/wd-google-maps_1-0-72_1\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-0037\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T20:18:59.817232Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T20:19:20.716Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-0037\", \"assignerOrgId\": \"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"WPScan\", \"dateReserved\": \"2023-01-03T13:33:27.282Z\", \"datePublished\": \"2023-03-13T16:03:32.276Z\", \"dateUpdated\": \"2025-02-27T20:19:24.314Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-0037

Vulnerability from fkie_nvd - Published: 2023-03-13 17:15 - Updated: 2025-02-27 21:15

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
contact@wpscan.com	https://bulletin.iese.de/post/wd-google-maps_1-0-72_1	Broken Link
contact@wpscan.com	https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bulletin.iese.de/post/wd-google-maps_1-0-72_1	Broken Link
af854a3a-2127-422b-91ae-364da2661108	https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	10web	map_builder_for_google_maps	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:10web:map_builder_for_google_maps:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "9842C196-76F8-4A79-B68C-43DE9DB76E6A",
              "versionEndExcluding": "1.0.73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection"
    }
  ],
  "id": "CVE-2023-0037",
  "lastModified": "2025-02-27T21:15:16.470",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2023-03-13T17:15:12.087",
  "references": [
    {
      "source": "contact@wpscan.com",
      "tags": [
        "Broken Link"
      ],
      "url": "https://bulletin.iese.de/post/wd-google-maps_1-0-72_1"
    },
    {
      "source": "contact@wpscan.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://bulletin.iese.de/post/wd-google-maps_1-0-72_1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56"
    }
  ],
  "sourceIdentifier": "contact@wpscan.com",
  "vulnStatus": "Modified"
}

GHSA-6GC2-7235-X8MP

Vulnerability from github – Published: 2023-03-13 18:30 – Updated: 2023-03-16 18:30

Details

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-0037"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-13T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",
  "id": "GHSA-6gc2-7235-x8mp",
  "modified": "2023-03-16T18:30:32Z",
  "published": "2023-03-13T18:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0037"
    },
    {
      "type": "WEB",
      "url": "https://bulletin.iese.de/post/wd-google-maps_1-0-72_1"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-0037

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-0037

Aliases

CVE-2023-0037

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-0037",
    "id": "GSD-2023-0037"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-0037"
      ],
      "details": "The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",
      "id": "GSD-2023-0037",
      "modified": "2023-12-13T01:20:22.189645Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "contact@wpscan.com",
        "ID": "CVE-2023-0037",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "10Web Map Builder for Google Maps",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "1.0.73"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Unknown"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Daniel Krohmer (Fraunhofer IESE)"
        },
        {
          "lang": "en",
          "value": "Kunal Sharma (University of Kaiserslautern)"
        },
        {
          "lang": "en",
          "value": "WPScan"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection"
          }
        ]
      },
      "generator": {
        "engine": "WPScan CVE Generator"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-89 SQL Injection"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56",
            "refsource": "MISC",
            "url": "https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56"
          },
          {
            "name": "https://bulletin.iese.de/post/wd-google-maps_1-0-72_1",
            "refsource": "MISC",
            "url": "https://bulletin.iese.de/post/wd-google-maps_1-0-72_1"
          }
        ]
      },
      "source": {
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:10web:map_builder_for_google_maps:*:*:*:*:*:wordpress:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.0.73",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2023-0037"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-89"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56"
            },
            {
              "name": "https://bulletin.iese.de/post/wd-google-maps_1-0-72_1",
              "refsource": "MISC",
              "tags": [
                "Broken Link"
              ],
              "url": "https://bulletin.iese.de/post/wd-google-maps_1-0-72_1"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-03-16T15:51Z",
      "publishedDate": "2023-03-13T17:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-0037 (GCVE-0-2023-0037)

FKIE_CVE-2023-0037

GHSA-6GC2-7235-X8MP

GSD-2023-0037

Tags

Sightings

Nomenclature