Store Locator for WordPress with Google Maps – LotsOfLocales, 4fa71b8c7d29c3050b951adfff5bf47b58228f4e

CVE, Research URL: 4fa71b8c7d29c3050b951adfff5bf47b58228f4e
Home page URL: Security reports for Store Locator for WordPress with Google Maps – LotsOfLocales
Application: Store Locator for WordPress with Google Maps – LotsOfLocales
Published on: Feb 09, 2015
Research Description: Store Locator for WordPress with Google Maps – LotsOfLocales [store-locator] < 3.34 (closed) Store Locator < 3.34 - SQL Injection The Store Locator Plugin for WordPress is vulnerable to blind SQL Injection via the sl_vars[num_initial_displayed] parameter in versions before 3.34 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 3.34.
Status: vulnerable