| 标题 | Part-DB 1.17.0 Cross-Site Scripting |
|---|
| 描述 | A Stored Cross-Site Scripting (XSS) vulnerability in the Change Profile Picture feature was found. The application allows users to upload .svg files as avatars. If a user uploads an SVG file containing embedded JavaScript, the script is executed when the image is accessed directly, which can lead to serious issues such as Account Takeover.
The vendor was contacted on May 11, 2025 and the issue was fixed in version 1.17.1 on May 18, 2025.
This vulnerability becomes more critical when exploited against administrator accounts. If an admin views the malicious image, the embedded script executes in their context. Since administrators have permission to modify user accounts, a malicious payload could, for example, automatically submit a POST request to /en/user/2/edit, changing the admin's account data and leading to a full account takeover.
Steps to Reproduce:
1. Log in with a user account that has permission to edit their profile picture.
2. Upload an SVG file containing malicious JavaScript (a proof-of-concept txt file is attached, change to svg when uploading).
3. Have an administrator view the image (via direct link or the Users tab).
4. The script will execute in the admin's context, potentially altering their account data.
You can find a detail description at https://github.com/b1d0ws/CVEs/blob/main/CVE-2025-XXXX.md. |
|---|
| 来源 | ⚠️ https://github.com/Part-DB/Part-DB-server/releases/tag/v1.17.1 |
|---|
| 用户 | b1d0ws (UID 74336) |
|---|
| 提交 | 2025-05-18 23時29分 (1 年前) |
|---|
| 管理 | 2025-05-20 15時37分 (2 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 309661 [Part-DB 直到 1.17.0 Profile Picture Feature AttachmentSubmitHandler.php handleUpload attachment 跨网站脚本] |
|---|
| 积分 | 20 |
|---|