Xunruicms Cross-Site Scripting Vulnerability Allowing Privilege Escalation

A cross-site scripting (XSS) vulnerability has been identified in Xunruicms versions through 4.6.3. This vulnerability allows remote attackers to escalate privileges by uploading a crafted SVG file that exploits the whitelisted file extension. The issue arises from inadequate validation of uploaded files, enabling the execution of malicious scripts.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files containing XSS payloads are executed within the application.

Reproduction

To reproduce this vulnerability, upload an SVG file containing a cross-site scripting payload through the Xunruicms backend content settings, specifically in the website settings section. The uploaded file will be executed, triggering the stored XSS vulnerability.