CVE-2019-9912: wpGoogleMaps 7.10.41 - Reflected XSS (WordPress Plugin)

• Vulnerability: XSS
• Affected Software: wpGoogleMaps (400,000+ active installations)
• Affected Version: 7.10.41
• Patched Version: 7.10.43
• Risk: Medium
• Vendor Contacted: 10/25/2018
• Vendor Fix: 10/31/2018
• Public Disclosure: 02/05/2019

CVSS

6.1 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

The wpGoogleMaps WordPress plugin is vulnerable to reflected XSS as it echoes PHP_SELF without proper encoding.

Successful exploitation allows an attacker to execute JavaScript in the context of the application in the name of an attacked user. This in turn enables an attacker to bypass CSRF protection and thus perform any actions the legitimate user can perform, as well as read data which the user can access.

Proof of Concept

http://192.168.0.103/wordpress/wp-admin/admin.php/'"><img src=x onerror=alert(1)>?page=wp-google-maps-menu&action=foo

Code

wp-google-maps/wpGoogleMaps.php                          
<input type='hidden' name='http_referer' value='".$_SERVER['PHP_SELF']."' />

Timeline

• 10/25/2018 Sent advisory
• 10/25/2018 Vendor confirms and releases fix
• 10/25/2018 Suggested improvement for fix
• 10/31/2018 Vendor releases improved fix
• 02/05/2019 Disclosure