Description

An attacker can upload and store a malicious SVG file in work forms and execute client side JavaScript code when opened.

Replication Steps and Proof of Concept

We create a file named file.svg containing the following:

<svg width="100%" height="100%" viewBox="0 0 100 100"
     xmlns="http://www.w3.org/2000/svg">
  <circle cx="50" cy="50" r="45" fill="green"
          id="foo"/>
  <script type="text/javascript">
    // <![CDATA[
      alert("XSS");
   // ]]>
  </script>
</svg>

We upload the file in an active work assignment inside any course.

Clicking the following link results in the following code execution:

Impact

An attacker can execute code and act as his assigned supervisor/teacher therefore performing any actions his supervisor could do for example changing grades, reading, writing and deleting unauthorized files, upload and remove content etc.