Submeter #607947: Portabilis i-diario 1.5.0 Cross Site Scripting

### Summary

An attacker can upload a malicious SVG file containing embedded JavaScript that is executed when the file is accessed directly. This results in Stored Cross-Site Scripting (XSS).

### Details

The `justificativas-de-falta` endpoint allows users to upload files after upload a crafted svg the XSS could be trigger when open the file.

Payload:
```
<svg xmlns="http://www.w3.org/2000/svg" fill="none">
<script>
alert("This is an XSS-POC from CVEHUNTERS");
</script>
</svg>
```

### PoC
Create the file with the payload and upload in the `justificativas-de-falta` endpoint:
After that open the file to trigger the XSS


### Impact

- Exploitation of these vulnerabilities allows an attacker to inject and store malicious JavaScript code on the server, which will be executed for all users accessing the affected pages. This malicious code can:
- Steal sensitive user information (e.g., session cookies, authentication tokens),
- Redirect users to malicious sites,
- Manipulate the application's interface, enabling phishing attacks and other social engineering techniques,
- Compromise the application's integrity, causing potentially severe impacts to user experience and security

by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)

• Fonte: ⚠️ https://github.com/nmmorette/vulnerability-research/tree/main/idiario
• Utilizador: nmmorette (UID 87361)
• Submissão: 02/07/2025 17h29 (há 10 meses)
• Moderação: 19/07/2025 07h53 (17 days later)
• Estado: Aceite
• Entrada VulDB: 316983 [Portabilis i-Diario 1.5.0 justificativas-de-falta Endpoint Anexo Script de Site Cruzado]
• Pontos: 20