https://moza369.github.io/tags/stored-xss/Recent content in Stored-Xss on MOZAHugoen-usMon, 04 Aug 2025 00:00:00 +0000https://moza369.github.io/writeups/stored-xss-svg-upload/Mon, 04 Aug 2025 00:00:00 +0000https://moza369.github.io/writeups/stored-xss-svg-upload/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>Web automation platform</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>Stored XSS via SVG Upload</td> </tr> <tr> <td><strong>Severity</strong></td> <td>Medium</td> </tr> <tr> <td><strong>Status</strong></td> <td>Resolved</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> </tbody> </table> <h2 id="the-story">The Story</h2> <p>After finding a CSRF on the same platform&rsquo;s editor, I kept digging. I started collecting all possible file upload forms to test for upload-based vulnerabilities.</p> <p>The platform&rsquo;s embed interface had a file input that caught my attention. Files uploaded through it were stored and served via a CDN subdomain. I crafted a simple SVG with a JavaScript payload and uploaded it.</p>