Description

Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-19T13:18:06.737Z",
  "pubdate": "2026-08-19T13:18:06.737Z",
  "executiveSummary": "An unauthenticated SQL Injection vulnerability has been identified in Maps Marker Pro versions 4.32 and below. This security flaw arises from insufficient sanitization and validation of user-supplied input before it is concatenated into database queries. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands directly against the underlying database management system. Successful exploitation of this vulnerability can lead to severe operational and security consequences, including unauthorized access to sensitive database contents, data exfiltration, modification or destruction of critical application data, and potentially full compromise of the hosting web application and server environment. Attackers require no prior authentication or administrative privileges to interact with the vulnerable endpoints, lowering the exploitation barrier significantly. Remediation requires updating the affected product to a patched version once available or implementing strict input parameter validation and query parameterization controls.",
  "technicalDetails": "The vulnerability resides within the request handling and query construction logic of Maps Marker Pro versions 4.32 and below. Specifically, input parameters received via HTTP requests are passed directly into database query statements without adequate parameterization, escaping, or strict type casting, leading to a classic SQL Injection condition. The affected component fails to enforce proper data sanitization, permitting malicious SQL syntax to manipulate the structure of the executed queries. Because the vulnerable endpoints are exposed over the network and do not enforce authentication checks, an unauthenticated remote attacker can issue crafted HTTP GET or POST requests containing malicious SQL payloads. The attack flow commences when the attacker identifies a vulnerable parameter processed by the application's backend database abstraction layer. By injecting malicious operators, UNION-based queries, or stacked statements, the attacker forces the database server to evaluate the injected commands alongside or instead of the original query logic. Depending on the database privileges associated with the application connection, the post-exploitation impact includes the retrieval of sensitive tables such as user credentials, configuration data, and proprietary geographical information. Furthermore, depending on the database configuration and underlying operating system permissions, advanced SQL injection techniques could theoretically facilitate file reading and writing or remote command execution."
}