Skip to content

Instantly share code, notes, and snippets.

@0xCaptainFahim

0xCaptainFahim/CVE-2026-1154.md Secret

Last active March 14, 2026 09:12
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save 0xCaptainFahim/dada955760b424a851de12bccadee997 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save 0xCaptainFahim/dada955760b424a851de12bccadee997 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
CVE-2026-1154.md

Title: [Stored Cross-Site Scripting (XSS)] via File Upload in [E-Learning System (CAIWL)] <= [v1.0]

  • BUG Author: [Md. Fahim Shakil Chowdhury]

  • Linkedin ID: Linkedin - Md. Fahim Shakil Chowdhury
  • Alias: 0xCaptainFahim
  • Affected Vendor: CAIWL Developers
  • Product: E-Learning System (CAIWL)
  • Edition: Open Source / Standard
  • Version: Tested on v1.0
  • Vulnerability Type: Stored Cross-Site Scripting (XSS)
  • Severity: High to Critical
  • CVE ID: [CVE-2026-1154]

Vulnerability Summary

A Critical Stored Cross-Site Scripting (XSS) vulnerability was identified in the E-Learning System (CAIWL) v1.0 within the Lesson Module. The vulnerability arises from unrestricted file uploads that allow an attacker to upload malicious .svg (Scalable Vector Graphics) files containing embedded JavaScript. When an administrator or user views the uploaded file via the built-in viewer, the malicious script executes immediately in the victim's browser, leading to potential session hijacking and unauthorized administrative actions.

Product Details

  • Product: E-Learning System (CAIWL)
  • Edition: Standard
  • Version: <= v1.0
  • Platform: PHP/MySQL (Tested on Localhost)
  • Architecture: Web Application
  • Vulnerable Component: File Upload Handler & PDF/Document Viewer

Vulnerability Description

The vulnerability exists because the application allows the upload of SVG files without sanitizing or validating their contents for malicious code (specifically XML-embedded scripts). Browsers render SVG files as XML, meaning any <script> tags inside the SVG are executed as valid JavaScript. An attacker can upload a crafted SVG file, and upon viewing, the code executes in the context of the user's session.

Technical Details

The exploit leverages the view=viewpdf functionality and the lack of file type sanitization:

  1. Unrestricted Upload: The upload handler accepts .svg extensions.
  2. MIME Type Mishandling: The application serves the SVG file which the browser interprets, including script tags.
  3. Stored Execution: The file persists on the server and is executed whenever accessed.

Key Exploitation Components:

  • /admin/modules/lesson/index.php?view=viewpdf
  • File Upload Handler (file parameter)
  • SVG XML Parser in Browser

Proof of Concept

Exploit Payload (xss.svg):

<svg xmlns="[http://www.w3.org/2000/svg](http://www.w3.org/2000/svg)" onload="alert('XSS POC by 0xCaptainFahim')">
    <script>alert("XSS POC by 0xCaptainFahim")</script>
</svg>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment