Joomla! Googlemaps Plugin Multiple Remote Security Vulnerabilities

Bugtraq ID:	61203
Class:	Input Validation Error
CVE:	CVE-2013-7428 CVE-2013-7430 CVE-2013-7429
Remote:	Yes
Local:	No
Published:	Jul 16 2013 12:00AM
Updated:	Mar 08 2015 04:04PM
Credit:	MustLive
Vulnerable:
Not Vulnerable:

Joomla! Googlemaps Plugin Multiple Remote Security Vulnerabilities

Joomla! Googlemaps Plugin is prone to a cross-site scripting vulnerability, an XML-injection vulnerability, and a denial-of-service vulnerability because it fails to properly handle user-supplied input.

An attacker may leverage these issues to cause denial-of-service conditions, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, and to launch other attacks.

Joomla! Googlemaps Plugin Multiple Remote Security Vulnerabilities

An attacker can exploit these issues using a web browser. To exploit the cross-site scripting issue an attacker must entice an unsuspecting user to follow a malicious URI.

The following example URI is available:

http://www.example.com/plugins/content/plugin_googlemap2_proxy.php?url=%3Cbody%20onload=alert(document.cookie)%3E

Joomla! Googlemaps Plugin Multiple Remote Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Joomla! Googlemaps Plugin Multiple Remote Security Vulnerabilities

References: