SPIP File Upload Vulnerability Leading to Admin Account Spoofing

A file upload vulnerability has been identified in SPIP version 4.1.10, allowing attackers to upload malicious SVG files containing embedded external links. This vulnerability arises from inadequate file upload filtering. Attackers can exploit this by tricking administrators into clicking on a crafted SVG logo, which redirects to a potentially harmful URL.

Impact

Exploitation of this vulnerability could lead to spoofing attacks, where an administrator is misled into clicking a malicious link, potentially causing harm to the website or its users.

Reproduction

To reproduce this vulnerability, upload an SVG file that includes a link to an external URL. Once the file is uploaded, it can be presented as a logo. When an administrator clicks on the logo, they will be redirected to the external URL, which could be harmful.