PT-2022-13248 · WordPress · Mappress Maps

Qerogram · Published 2022-04-04 · Updated 2023-02-09 · CVE-2022-0537

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MapPress Maps for WordPress versions prior to 2.73.13

Description The issue allows a high privileged user to bypass certain security settings and upload arbitrary files to the site through the ajax save function. The file is written relative to the current stylesheet directory with a .php file extension added, and no validation is performed on the file's content. This can trigger a remote code execution (RCE) vulnerability by uploading a web shell. Additionally, the name parameter is not sanitized, allowing the payload to be uploaded to any directory the server has write access to.

Recommendations For versions prior to 2.73.13, update to version 2.73.13 or later to resolve the issue. As a temporary workaround, consider disabling the ajax save function until a patch is available. Restrict access to the stylesheet directory to minimize the risk of exploitation. Avoid using the name parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-0537

Affected Products

Mappress Maps

References · 4

• 🔥 https://wpscan.com/vulnerability/abfbba70-5158-4990-98e5-f302361db367 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0537 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0537 · Vendor Advisory
• https://t.me/cvenotify/28396 · Telegram Post