CVE-2013-2618

EXPLOITED IN THE WILD RANSOMWARE

Network Weathermap < 0.97b - Stored Cross-Site Scripting via Map Title Parameter

Title source: llm

Exploitation Summary

CVE-2013-2618 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns. EIP tracks 1 public exploit from researchers including Daniel Ricardo dos Santos.

AI-analyzed exploit summary This is a detailed writeup describing a persistent XSS vulnerability in Network Weathermap 0.97a. The vulnerability allows an attacker to inject malicious JavaScript into the map title, which is later executed when displayed in the editor interface.

Description

Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inject arbitrary web script or HTML via the map_title parameter.

Exploits (1)

exploitdb WRITEUP

by Daniel Ricardo dos Santos · textwebappsphp

https://www.exploit-db.com/exploits/24913

View Code ZIP pw:eip

This is a detailed writeup describing a persistent XSS vulnerability in Network Weathermap 0.97a. The vulnerability allows an attacker to inject malicious JavaScript into the map title, which is later executed when displayed in the editor interface.

Classification

Writeup 100%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Network Weathermap 0.97a

Auth required

Prerequisites: Access to the editor.php interface · Ability to create or edit a map

MITRE ATT&CK