| शीर्षक | givanz Vvveb Vvveb 1.0.7.2 File Upload |
|---|
| विवरण | A critical file upload vulnerability in Vvveb CMS allows attackers to bypass security controls by appending special characters to file extensions (e.g., .svg/). This enables upload of malicious SVG+XML files containing JavaScript payloads. The vulnerability can be exploited through multiple attack vectors: direct admin access to uploaded files, iframe injection in posts/pages/products, or plugin code editor functionality. Successful exploitation allows attackers to execute XSS attacks that can create superadministrator accounts, upload and activate malicious plugins, and ultimately achieve remote code execution on the server. The attack chain demonstrates complete system compromise from initial file upload to reverse shell access. |
|---|
| स्रोत | ⚠️ https://gist.github.com/KhanMarshaI/b90045ee823866a52f33615776b5a6ec |
|---|
| उपयोगकर्ता | KhanMarshal (UID 89610) |
|---|
| सबमिशन | 17/09/2025 12:11 PM (1 वर्ष पहले) |
|---|
| संयम | 26/09/2025 10:24 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 325965 [givanz Vvveb तक 1.0.7.2 SVG File क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|