CVE-2023-4382
LOWtdevs hyip_rio 2.1 - Cross-Site Scripting via Profile Settings Avatar Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-4382. PoCs published by CraCkEr.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in Hyip Rio 2.1, allowing attackers to upload malicious SVG files containing stored XSS payloads. The PoC shows how to bypass file extension checks by uploading an SVG file with embedded JavaScript.
Description
A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be launched remotely. VDB-237314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Exploits (1)
This exploit demonstrates an arbitrary file upload vulnerability in Hyip Rio 2.1, allowing attackers to upload malicious SVG files containing stored XSS payloads. The PoC shows how to bypass file extension checks by uploading an SVG file with embedded JavaScript.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N