CVE-2023-53900
HIGHSpip 4.1.10 - Stored Cross-Site Scripting via Malicious SVG Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-53900. PoCs published by nu11secur1ty.
AI-analyzed exploit summary This exploit demonstrates a spoofing vulnerability in SPIP v4.1.10 where a malicious SVG file can be uploaded to trick an administrator into clicking a link. The SVG contains an embedded hyperlink that redirects to an external URL, leveraging improper file upload sanitization.
Description
Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administrators into clicking a crafted SVG logo that redirects to a potentially dangerous URL through improper file upload filtering.
Exploits (1)
This exploit demonstrates a spoofing vulnerability in SPIP v4.1.10 where a malicious SVG file can be uploaded to trick an administrator into clicking a link. The SVG contains an embedded hyperlink that redirects to an external URL, leveraging improper file upload sanitization.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H