CyberRota Analysis
AI-GeneratedLaraDashboard versions 0.9.0 through 1.2.2 are vulnerable due to inadequate sanitization of SVG file content during media uploads, allowing authenticated users with media.create permissions to upload malicious SVG files. This vulnerability can lead to the execution of embedded JavaScript, potentially resulting in session hijacking and administrative account takeover when the SVG is accessed. Organizations using affected versions should prioritize remediation to protect against these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.