Description

Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-20T12:16:35.943Z",
  "pubdate": "2026-08-20T12:16:35.943Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified in the Locatoraid Store Locator plugin affecting versions 3.9.72 and prior. This security flaw arises from insufficient sanitization and validation of user-supplied input parameters before being concatenated directly into database queries executed by the application.\nThe vulnerability allows remote, unauthenticated attackers to manipulate database query logic by injecting malicious SQL payloads through vulnerable HTTP request parameters. Successful exploitation of this flaw can grant unauthorized access to sensitive backend database contents, including application data, administrative credentials, and potentially underlying server file systems depending on database configurations and privileges.\nThe risk implications are severe, as the lack of required authentication or prior privilege requirements enables widespread automated exploitation across exposed instances. Attackers can leverage this vulnerability to extract confidential information, bypass access controls, or perform database-level modifications. Immediate remediation is critical to prevent complete data compromise and maintain the integrity of the affected web application environment.",
  "technicalDetails": "The vulnerability exists within the query handling logic of the Locatoraid Store Locator plugin for versions <= 3.9.72. The root cause stems from the insecure handling of dynamic parameters passed via HTTP requests, which are subsequently utilized in database operations without proper parameterization, escaping, or type casting.\nAttack flow begins when an unauthenticated remote attacker crafts an HTTP request containing malicious SQL syntax injected into vulnerable input fields processed by the application's backend database abstraction layer. Because the input is unsanitized, the database engine interprets the malicious input as executable SQL commands rather than literal string data, altering the intended query structure.\nThe vulnerable component involves specific endpoint handlers within the plugin that process search or filtering parameters for store location queries. Due to the absence of robust input validation mechanisms, these parameters are directly concatenated into SQL statements. Network exposure is external over HTTP/HTTPS, requiring no prior authentication or administrative privileges.\nPayload behavior during exploitation typically involves boolean-based, time-based blind, or union-based SQL injection techniques. Attackers may append SQL commands such as UNION SELECT statements to exfiltrate database contents, extract user table hashes, or harvest sensitive configuration data. Post-exploitation impact ranges from severe confidentiality breaches to full data exfiltration, and in environments with misconfigured database permissions, potential escalation to remote code execution or underlying operating system compromise."
}