제출 #607947: Portabilis i-diario 1.5.0 Cross Site Scripting

### Summary

An attacker can upload a malicious SVG file containing embedded JavaScript that is executed when the file is accessed directly. This results in Stored Cross-Site Scripting (XSS).

### Details

The `justificativas-de-falta` endpoint allows users to upload files after upload a crafted svg the XSS could be trigger when open the file.

Payload:
```
<svg xmlns="http://www.w3.org/2000/svg" fill="none">
<script>
alert("This is an XSS-POC from CVEHUNTERS");
</script>
</svg>
```

### PoC
Create the file with the payload and upload in the `justificativas-de-falta` endpoint:
After that open the file to trigger the XSS


### Impact

- Exploitation of these vulnerabilities allows an attacker to inject and store malicious JavaScript code on the server, which will be executed for all users accessing the affected pages. This malicious code can:
- Steal sensitive user information (e.g., session cookies, authentication tokens),
- Redirect users to malicious sites,
- Manipulate the application's interface, enabling phishing attacks and other social engineering techniques,
- Compromise the application's integrity, causing potentially severe impacts to user experience and security

by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)

• 원천: ⚠️ https://github.com/nmmorette/vulnerability-research/tree/main/idiario
• 사용자: nmmorette (UID 87361)
• 제출: 2025. 07. 02. PM 05:29 (1 년도 ago)
• 모더레이션: 2025. 07. 19. AM 07:53 (17 days later)
• 상태: 수락
• VulDB 항목: 316983 [Portabilis i-Diario 1.5.0 justificativas-de-falta Endpoint Anexo 크로스 사이트 스크립팅]
• 포인트들: 20