CVE-2012-10018

HIGHNuclei

Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2012-10018 has a selected CVSS score of 8.3 (high); EIP currently links 1 Nuclei template.

Description

The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 15, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 16, 2024 · Source: CVE List

Affected products and versions

5
ProductSourceVersion range

mapplic

Browse mapplic / mapplic

Default status: unknown

CVE ListBefore 6.2affected

mapplic_lite

Browse mapplic / mapplic_lite

Default status: unknown

CVE ListBefore 1.0.1affected

Mapplic - Custom Interactive Map WordPress Plugin

Browse sekler / Mapplic - Custom Interactive Map WordPress Plugin

Default status: unaffected

CVE ListBefore 6.2affected

Mapplic Lite

Browse sekler / Mapplic Lite

Default status: unaffected

CVE ListBefore 1.0.1affected

Mapplic/Mapplic Lite

Browse sekler / Mapplic/Mapplic Lite
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHWordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File UploadCVSS 8.3

The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Stored Cross-Site Scripting via arbitrary URL injection in versions up to and including 6.1 and 1.0 respectively. Authenticated users with author-level permissions can inject arbitrary remote URLs for SVG map files. When a user views the map (admin panel or frontend page with shortcode), the browser fetches the SVG via jQuery .load() and inserts it into the DOM. If the SVG contains embedded JavaScript, it executes as XSS.

Impact

An attacker with author-level access can inject URLs pointing to malicious SVG files containing JavaScript payloads. When any user views the map, the browser loads the SVG and executes the embedded scripts, potentially leading to session hijacking, privilege escalation, or complete site compromise.

Remediation

Update Mapplic to version 7.0 or later, and Mapplic Lite to version 1.0.1 or later.

WeaknessesCWE-79
AuthorsKrE80r
Template tagscvecve2012wordpresswp-pluginxssmapplicvkevauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CPE: cpe:2.3:a:mapplic:mapplic:*:*:*:*:*:wordpress:*:*
https://nvd.nist.gov/vuln/detail/CVE-2012-10018 https://wpscan.com/vulnerability/7bdee32b-9036-4e13-9586-4d6a9a1159c6/ https://patchstack.com/database/wordpress/plugin/mapplic-lite/vulnerability/wordpress-mapplic-lite-plugin-1-0-stored-cross-site-scripting-xss-injection-via-server-side-request-forgery-ssrf-vulnerability https://packetstormsecurity.com/files/161920/WordPress-Mapplic-6.1-SSRF-Cross-Site-Scripting.html

Source: ProjectDiscovery

References

6