Phpwcms File Upload Vulnerability Allowing Cross-Site Scripting

A file upload vulnerability has been identified in Phpwcms version 1.9.30. This vulnerability allows authenticated attackers to upload malicious SVG files containing embedded JavaScript. The crafted SVG payloads can be uploaded through the multiple file upload feature, potentially leading to cross-site scripting attacks on the platform.

Impact

Exploitation of this vulnerability could result in cross-site scripting attacks, allowing for the execution of malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the Phpwcms application and navigate to the multiple file upload feature. Create a payload by crafting an SVG file that includes JavaScript, such as an alert script. Once the payload is ready, upload it through the file upload interface. After uploading, the SVG file can be accessed from the upload directory, where the embedded JavaScript will be executed.