| タイトル | Part-DB 1.17.0 Cross-Site Scripting |
|---|
| 説明 | A Stored Cross-Site Scripting (XSS) vulnerability in the Change Profile Picture feature was found. The application allows users to upload .svg files as avatars. If a user uploads an SVG file containing embedded JavaScript, the script is executed when the image is accessed directly, which can lead to serious issues such as Account Takeover.
The vendor was contacted on May 11, 2025 and the issue was fixed in version 1.17.1 on May 18, 2025.
This vulnerability becomes more critical when exploited against administrator accounts. If an admin views the malicious image, the embedded script executes in their context. Since administrators have permission to modify user accounts, a malicious payload could, for example, automatically submit a POST request to /en/user/2/edit, changing the admin's account data and leading to a full account takeover.
Steps to Reproduce:
1. Log in with a user account that has permission to edit their profile picture.
2. Upload an SVG file containing malicious JavaScript (a proof-of-concept txt file is attached, change to svg when uploading).
3. Have an administrator view the image (via direct link or the Users tab).
4. The script will execute in the admin's context, potentially altering their account data.
You can find a detail description at https://github.com/b1d0ws/CVEs/blob/main/CVE-2025-XXXX.md. |
|---|
| ソース | ⚠️ https://github.com/Part-DB/Part-DB-server/releases/tag/v1.17.1 |
|---|
| ユーザー | b1d0ws (UID 74336) |
|---|
| 送信 | 2025年05月18日 23:29 (1 年 ago) |
|---|
| モデレーション | 2025年05月20日 15:37 (2 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 309661 [Part-DB 迄 1.17.0 Profile Picture Feature AttachmentSubmitHandler.php handleUpload attachment クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|