CVE-2018-11564

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in YOOtheme Pagekit CMS versions 1.0.13 and earlier [2][4]. The picture upload feature does not sanitize SVG files, allowing a user with elevated privileges to upload a malicious SVG as a photo. The file is stored at /storage/poc.svg without filtering or stripping of embedded scripts [2][4].

Exploitation

An attacker with elevated privileges (e.g., a content editor) can craft an SVG file containing JavaScript payload and upload it via the picture upload interface [2]. After upload, the file is accessible via a URL such as http://localhost/pagekit/storage/poc.svg. The attacker then creates a link on the site pointing to that SVG. When another user clicks that link, the SVG renders and the embedded script executes in the context of the victim's browser [4].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who clicks the malicious link. This can lead to session hijacking, defacement, or theft of sensitive information within the CMS context. The attack requires victim interaction (clicking a link).

Mitigation

As of the available references, no patch has been released; the vulnerability exists in all versions up to 1.0.13 [2]. Users should upgrade to a version newer than 1.0.13 if available. As a workaround, administrators can restrict SVG uploads by modifying server configurations or implementing input validation to strip script content from uploaded SVG files. The Pagekit project on GitHub [3] should be monitored for future fixes.