Storage xss vulnerability exists in simple graph beds
Discription

# Description
Storage xss vulnerability exists in simple graph beds,By constructing a malicious svg code that directs the administrator to click, the cookie is stolen

# Proof of Concept
Make the svg file as follows
“`
xml version=”1.0″ standalone=”no”? >

“`
You can steal administrator cookies,No login required to upload svg files on the home page,Then the proof talks about administrator cookies,Set up a local environment and log in as an administrator
![2](https://api.80ym.net/i/2023/03/02/rdke34.png)
Upload the svg xss payload we constructed to the graph bed system
![3](https://api.80ym.net/i/2023/03/02/rdkgyh.png)
If yes, xss cookie theft will be triggered
![4](https://api.80ym.net/i/2023/03/02/rdkqfd.png)
Successfully get cookie
![5](https://api.80ym.net/i/2023/03/02/rdknjn.png)Read More

References

Back to Main
Subscribe for the latest news: