MyEMS Stored Cross-Site Scripting Vulnerability in Admin Backend

A stored cross-site scripting vulnerability has been identified in MyEMS versions prior to 6.4.0. The issue resides in the Admin Backend, specifically within the 'on_post' function of 'myems-api/core/svg.py'. This vulnerability allows remote attackers to inject malicious SVG data that is saved and later executed, potentially leading to session cookie theft and account takeover, including administrative accounts.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected content. This could lead to session hijacking, with an attacker able to take over the accounts of users, including administrators.

Reproduction

To reproduce this vulnerability, log in as an admin user and navigate to the SVG code upload page. Upload a crafted SVG payload containing a script, such as one using a 'foreignObject' to include an iframe with a JavaScript URL. After saving, the injected script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to upgrade to MyEMS version 6.5.0, where this vulnerability has been fixed.