Stored XSS viva .svg file upload in luyadev/luya-module-admin
Apr 1st 2022
The application allows .svg files to upload which leads to stored XSS.
Proof of Concept
1.Download the payload XSS.svg from below drive link and go to "Files".
2.Now click on "Add file" and upload the downloaded payload.
3.Then see the uploaded file details and open the file path once you open XSS will trigger (Link:- https://demo.luya.io/storage/xss_197a764d.svg)
This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.