GHSA-cgr4-c233-h733
Suggest an improvement- Source
- https://github.com/advisories/GHSA-cgr4-c233-h733
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-cgr4-c233-h733/GHSA-cgr4-c233-h733.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-cgr4-c233-h733
- Aliases
- Published
- 2024-11-13T18:37:15Z
- Modified
- 2024-11-13T19:12:23Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- UnoPim Stored XSS : Cookie hijacking through Create User function
- Details
-
Summary
A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies.
Details
- Login as admin
- Go to Create User
- Fill up everything in the registration form then upload SVG image as a profile picture
- In SVG image, add script tag to prepare for XSS attack
- Complete the Create User process
- Right click at the image to obtain image URL address
- XSS triggered
PoC
The below link is a private YouTube video for PoC. https://youtu.be/5j8owD0--1A
Impact
The stored XSS can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place.
- Database specific
{ "cwe_ids": [ "CWE-616", "CWE-692", "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2024-11-13T18:37:15Z", "nvd_published_at": "2024-11-13T16:15:20Z", "severity": "MODERATE" }- References
Affected packages
Packagist / unopim/unopim
Package
- Name
- unopim/unopim
- Purl
- pkg:composer/unopim/unopim