💣Exploit Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload

[Bad]

An arbitrary file upload vulnerability in Campcodes Online Matrimonial
Website System Script v3.3 allows attackers to execute arbitrary code via
uploading a crafted SVG file.


SVG Payload:

To view the content, you need to Sign In or Register.

Steps to reproduce

-Login with your creds
-Navigate to this directory - /profile-settings
-Click on Gallery -> Add New Image -> Browser -> Add Files
-Choose the SVG file and upload done
-Click the image!! Payload Triggered


Burp Request

To view the content, you need to Sign In or Register.

 

[Nooby94]

Cool