Description

By uploading SVG files, the users can perform Stored XSS attack.

Payload

Copy the following code and save as filename.svg.
<x:script xmlns:x="http://www.w3.org/1999/xhtml">alert(document.domain)</x:script>

Proof of Concept

[1] Login as admin.

[2] upload the payload injected SVG file at
https://demo.microweber.org/demo/admin/view:modules/load_module:files

[3] Copy the uploaded svg file url and open in new tab.

[4] XSS!