CVE-2023-53876

EIP tracks 1 public exploit for CVE-2023-53876. PoCs published by CraCkEr.

AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in Academy LMS 6.1, allowing attackers to upload malicious SVG files containing stored XSS payloads. The PoC shows how to bypass file extension checks by intercepting and modifying a POST request to upload an SVG file with embedded JavaScript.

Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.