CVE-2024-3604
📋 TL;DR
This SQL injection vulnerability in the OSM OpenStreetMap WordPress plugin allows authenticated attackers with contributor-level access or higher to inject malicious SQL queries via the 'tagged_filter' shortcode attribute. Attackers can extract sensitive information from the database, including user credentials and other confidential data. All WordPress sites using the OSM plugin version 6.0.2 or earlier are affected.
💻 Affected Systems
- OSM - OpenStreetMap WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to credential theft, data exfiltration, privilege escalation, and potential site takeover.
Likely Case
Extraction of sensitive user data, plugin/theme configuration secrets, and potential privilege escalation to administrator.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, restricting data exposure to non-sensitive tables.
🎯 Exploit Status
Exploitation requires contributor-level access. SQL injection via shortcode attribute is straightforward for attackers with basic WordPress knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.3
Vendor Advisory: https://wordpress.org/plugins/osm/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'OSM - OpenStreetMap' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 6.0.3+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable OSM Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate osm
Remove Contributor SQL Permissions
allTemporarily restrict contributor-level users from posting content with shortcodes
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns in POST/GET parameters
- Restrict contributor-level user access and implement principle of least privilege
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → OSM - OpenStreetMap → Version number. If version is 6.0.2 or lower, you are vulnerable.Check Version:
wp plugin get osm --field=versionVerify Fix Applied:
Verify plugin version is 6.0.3 or higher in WordPress admin panel. Test 'tagged_filter' parameter with SQL injection payloads to confirm mitigation.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from WordPress users
- Multiple failed SQL queries from contributor-level accounts
- POST requests containing SQL keywords to wp-admin/admin-ajax.php
Network Indicators:
- Unusual outbound database connections from web server
- Large data exfiltration patterns from WordPress site
SIEM Query:
source="wordpress.log" AND ("tagged_filter" OR "osm_map_v3") AND ("UNION" OR "SELECT" OR "INSERT" OR "UPDATE" OR "DELETE")