SVXportal Stored Cross-Site Scripting Vulnerability in User Profile Update

A stored cross-site scripting vulnerability has been identified in SVXportal versions through 2.5. This issue arises in the user profile update process, specifically within the 'user_settings.php' file that submits data to 'admin/update_user.php'. Authenticated users can inject malicious HTML or JavaScript into fields such as Firstname, lastname, email, and image_url. This injected content is later displayed in the administrator interface ('admin/users.php') without proper output encoding, allowing the execution of JavaScript in the browser of an administrator viewing the page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.