CVE-2020-37242: Supsystic Ultimate Maps SQLi Vulnerability

CVE-2020-37242 Overview

CVE-2020-37242 is an SQL injection vulnerability in the Supsystic Ultimate Maps WordPress plugin version 1.1.12. The flaw resides in the getListForTbl action, where the sidx GET parameter is concatenated into a database query without proper sanitization. Unauthenticated attackers can send crafted HTTP requests to extract sensitive data from the underlying database. Both boolean-based blind and time-based blind SQL injection techniques are viable against the affected endpoint. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can extract arbitrary database contents, including WordPress user credentials and session tokens, from any site running the vulnerable plugin.

Affected Products

Supsystic Ultimate Maps WordPress plugin version 1.1.12
WordPress sites with the ultimate-maps-by-supsystic plugin installed
Deployments exposing the getListForTbl admin-ajax action to unauthenticated requests

Discovery Timeline

2026-05-16 - CVE-2020-37242 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2020-37242

Vulnerability Analysis

The Supsystic Ultimate Maps plugin exposes a getListForTbl action through the WordPress AJAX interface. This action accepts a sidx parameter intended to specify the column used for sorting table results. The plugin passes the value of sidx directly into a SQL ORDER BY clause without escaping or whitelisting against known column names.

Because the parameter is reflected inside a query but the response does not return raw SQL output, attackers rely on inference techniques. Boolean-based payloads compare response differences when injected conditions are true versus false. Time-based payloads use SLEEP() or equivalent functions to infer data one bit at a time from observable response delays.

The endpoint requires no authentication, so any internet-facing WordPress installation running the affected plugin version is exposed. Successful exploitation enables retrieval of the wp_users table, including password hashes, and any other data accessible to the WordPress database user.

Root Cause

The root cause is improper neutralization of user-supplied input concatenated into a dynamic SQL statement [CWE-89]. The sidx parameter is intended to be a column identifier but is treated as trusted string content. WordPress provides esc_sql() and $wpdb->prepare() for parameterized queries, neither of which is applied to the sidx value in version 1.1.12.

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax.php endpoint. An attacker sends a GET or POST request invoking the getListForTbl action with a malicious sidx value. The vulnerability mechanism is described in the VulnCheck Advisory for SupSystic SQL Injection and a working proof of concept is published as Exploit-DB #49532.

The affected plugin archive is available at WordPress Plugin Ultimate Maps for analysis. See the public proof of concept for technical payload details rather than reproducing them here.

Detection Methods for CVE-2020-37242

Indicators of Compromise

HTTP requests to /wp-admin/admin-ajax.php containing the getListForTbl action with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or CASE WHEN inside the sidx parameter.
Anomalous response latency from admin-ajax.php consistent with time-based blind SQL injection probes.
Database query logs showing malformed ORDER BY clauses originating from the plugin.
Outbound web requests from clients enumerating sidx values in rapid succession from a single source IP.

Detection Strategies

Inspect web server access logs for query strings combining action=getListForTbl with non-alphanumeric characters in sidx.
Deploy web application firewall rules that flag SQL metacharacters in WordPress AJAX parameters.
Enable MySQL general query logging temporarily on suspected hosts and review ORDER BY clauses for injected expressions.

Monitoring Recommendations

Alert on repeated 200-response requests to admin-ajax.php with response times exceeding configured baselines.
Correlate WordPress access logs with database error logs to surface failed SQL parse attempts tied to the plugin.
Track installed plugin inventory and version metadata across managed WordPress hosts to identify exposed instances.

How to Mitigate CVE-2020-37242

Immediate Actions Required

Identify WordPress sites running Supsystic Ultimate Maps version 1.1.12 and disable the plugin until a patched release is verified.
Block unauthenticated requests to admin-ajax.php with the getListForTbl action at the web application firewall.
Rotate WordPress administrator credentials and database user passwords if the plugin has been exposed to the internet.
Audit the wp_users table and recent login activity for signs of credential theft or unauthorized access.

Patch Information

No vendor patch is referenced in the available advisory data. Review the SupSystic Website and the WordPress plugin repository for the latest release, and upgrade beyond version 1.1.12 once a fixed build is confirmed. If a fixed version is not available, removing the plugin is the recommended action.

Workarounds

Uninstall the Ultimate Maps by Supsystic plugin on systems where mapping functionality is non-essential.
Restrict access to admin-ajax.php from untrusted networks using IP allowlists or authentication proxies where feasible.
Apply a virtual patch via WAF that rejects any sidx parameter value not matching a strict allowlist of expected column names.

bash

# Example ModSecurity rule to block SQL metacharacters in the sidx parameter
SecRule ARGS:sidx "@rx [^a-zA-Z0-9_]" \
    "id:1003724,phase:2,deny,status:403,\
    msg:'CVE-2020-37242 Supsystic Ultimate Maps sidx SQLi attempt',\
    tag:'CWE-89'"