CVE-2022-1123 Leaflet Maps Marker < 3.12.5 - Admin+ SQLi
High-privilege users can perform SQL injection attacks in the Leaflet Maps Marker WordPress plugin due to improper parameter sanitization.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1123?
CVE-2022-1123 is a high-severity SQL injection vulnerability in Unknown Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps), published on 29 Aug 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks.
Weakness: CWE-89
Which versions are affected by CVE-2022-1123?
It affects 1 product.
Products include Mapsmarker Leaflet Maps Marker.
How do I fix CVE-2022-1123?
No fix has been published for CVE-2022-1123 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-1123 being exploited?
There is no known exploitation of CVE-2022-1123 in the wild and no public exploit code.
Other vulnerabilities in Unknown Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)
Sources
Also known as GHSA-q7xc-mr7x-v3ph.