0xn4d/poc-cve-xss-uploading-svgProof-of-concept for CVE-2023-4460: authenticated reflected and stored XSS in WordPress plugin Uploading SVG, WEBP and ICO files, triggered via malicious SVG upload.
Title: Authenticated Reflected Cross-Site Scripting in "Uploading SVG, WEBP and ICO files" Plugin for WordPress CMS
Date: 2023-08-10
Author: Danilo Albuquerque
Vendor Homepage: https://wordpress.org
Software Link: https://wordpress.org/download
Version: WordPress 6.3
Plugin's Name and Version: Uploading SVG, WEBP and ICO files 1.2.1
Tested on: Brave (Version 1.50.119 Chromium: 112.0.5615.121 (Official Version) 64 bits)
When you do all that and update the current page, it will bring you the alert pop-up with the message in it.
No plugin PoC:
When there is no plugin the SVG file uploading does not work:
The plugin's version in this day:
The plugin is now installed and activated:
Created the SVG file with the malicious payload within it:
SVG file's upload done:
Payload triggered when the file is loaded:
Changed the content of the malicious file:
Got the POST request in my Collaborator oastify:
