Location Manager
Monthly
Unauthenticated SQL injection in the Location Manager plugin for WordPress allows remote attackers to read arbitrary data from the underlying database. Every installation running version 2.3.38 or earlier is exposed, because the publicly reachable REST routes geodir/v2/locations/cities, /regions, /countries and /neighbourhoods pass the 'latitude' and 'longitude' parameters into SQL through the get_locations() and get_neighbourhoods() functions without escaping or query preparation whenever orderby=lat_lon is supplied. No authentication, user interaction, or non-default configuration is needed, giving the issue a CVSS 3.1 base score of 7.5 with high confidentiality impact; no public exploit code has been identified at time of analysis and there is no evidence of active exploitation.
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated SQL injection in the Location Manager plugin for WordPress allows remote attackers to read arbitrary data from the underlying database. Every installation running version 2.3.38 or earlier is exposed, because the publicly reachable REST routes geodir/v2/locations/cities, /regions, /countries and /neighbourhoods pass the 'latitude' and 'longitude' parameters into SQL through the get_locations() and get_neighbourhoods() functions without escaping or query preparation whenever orderby=lat_lon is supplied. No authentication, user interaction, or non-default configuration is needed, giving the issue a CVSS 3.1 base score of 7.5 with high confidentiality impact; no public exploit code has been identified at time of analysis and there is no evidence of active exploitation.
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.