Description

WordPress Plugin GeoDirectory Location Manager is prone to multiple SQL injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin GeoDirectory Location Manager version 2.1.0.9 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.1.0.10 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:5AFF50FC-AC96-4076-A07C-BB145AE37025

https://wpgeodirectory.com/downloads/location-manager/?changelog=1

Related Vulnerabilities

Atlassian Confluence Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-26072)

Oracle Database Server Other Vulnerability (CVE-2001-0832)

XOOPS Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-0612)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Cross-Site Scripting (1.2.3)

YOURLS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-8488)

Severity

High

Classification

CVE-2021-24361 CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection