GeoDirectory Location Manager < 2.1.0.10 - Multiple Unauthenticated SQL Injections
CVE-2021-24361

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Location Manager
Vendor
CVE Published:
21 June 2021

What is CVE-2021-24361?

In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.

Affected Version(s)

Location Manager 2.1.0.10

References

https://wpscan.com/vulnerability/5aff50fc-ac96-4076-a07c-...
x_refsource_CONFIRM
https://wpgeodirectory.com/downloads/location-manager/
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafal Goryl
.