CVE-2024-3604 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection (SQLi) in OSM – OpenStreetMap plugin. <br>💥 **Consequences**: Attackers can extract sensitive data from the database.…

🛡️ **Root Cause**: CWE-89 (SQL Injection). <br>🔍 **Flaw**: Insufficient escaping of user-supplied parameters. The plugin fails to properly sanitize inputs before querying the database.

📦 **Affected**: WordPress Plugin: **OSM – OpenStreetMap**. <br>📅 **Version**: **6.0.2 and earlier**. <br>🏢 **Vendor**: photoweblog.

💻 **Attacker Actions**: Extract sensitive information from the database. <br>🔑 **Privileges**: Requires **Authenticated** access. <br>📊 **Impact**: High (C:H, I:H, A:H) according to CVSS 3.1.

⚠️ **Threshold**: Medium. <br>🔒 **Requirement**: **Privileges Required: Low (PR:L)**. <br>👤 **Condition**: The attacker must be **authenticated** to exploit this vulnerability. It is not remote unauthenticated.

🚫 **Public Exp?**: **No**. <br>📝 **PoC**: The `pocs` field is empty. No public Proof of Concept or wild exploitation code is currently available in the provided data.

🔍 **Self-Check**: <br>1. Check WordPress plugin list for **OSM – OpenStreetMap**. <br>2. Verify version is **≤ 6.0.2**. <br>3. Use scanners to detect SQLi patterns in plugin endpoints if authenticated.

✅ **Fixed?**: **Yes**. <br>🔗 **Patch**: Reference to `plugins.trac.wordpress.org/changeset/3153019` indicates a fix was committed.…

🛡️ **Workaround**: <br>1. **Disable** the plugin if not strictly needed. <br>2. **Restrict access** to WordPress admin areas (since auth is required). <br>3.…

🔥 **Urgency**: **High Priority**. <br>📉 **Reason**: CVSS Vector includes **S:C** (Changed Scope), meaning impact extends beyond the vulnerable component.…