medium5.4Public exploit code
CVE-2023-31698
Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)2023-05-23 · webapps · php · Verified
Impact
Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bludit | Bludit | Version 3.14.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/172462/Bludit-CMS-3.14.1-Cross-Site-Scripting.html
- https://github.com/bludit/bludit/issues/1212#issuecomment-649514491
- https://github.com/bludit/bludit/issues/1369#issuecomment-940806199
- https://github.com/bludit/bludit/issues/1509
- http://packetstormsecurity.com/files/172462/Bludit-CMS-3.14.1-Cross-Site-Scripting.html
- https://github.com/bludit/bludit/issues/1212#issuecomment-649514491
- https://github.com/bludit/bludit/issues/1369#issuecomment-940806199
- https://github.com/bludit/bludit/issues/1509