Snipe-IT Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in Snipe-IT version 4.7.5. This vulnerability allows authorized users to upload malicious SVG files containing embedded JavaScript. When these crafted SVG files are viewed by other users, the embedded JavaScript is executed, potentially leading to unauthorized actions or data exposure.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where uploaded SVG files execute JavaScript when accessed by users.

Reproduction

To reproduce this vulnerability, upload a crafted SVG file containing JavaScript payloads through the accessories section. Once the file is uploaded, access the location of the uploaded SVG file in a browser, which will trigger the execution of the JavaScript payload, such as displaying an alert box.