WordPress exploitation part 2 – unauthenticated SQL injection

Let's look at another case of SQL injection, which was discovered in the WordPress Google Maps plugin. Metasploit already has a built-in exploit module that extracts the wp_users table from the database:

auxiliary/admin/http/wp_google_maps_sqli

Before we run the module, let's look at the source code of the plugin and understand where the problem was.

Vulnerability flow and analysis

Looking at the source code of class.rest-api.php, we can see that the user input is passed as a get parameter named fields into the explode function. The explode function is used to split a string by a specified string into pieces:

Then, the input is stored in the $imploded...