CVE-2025-65675
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to inject malicious JavaScript via crafted SVG profile pictures. This enables attackers to execute arbitrary code in victims' browsers when they view the malicious profile. All users of Classroomio LMS 0.1.13 are affected.
💻 Affected Systems
- Classroomio LMS
📦 What is this software?
Classroomio by Classroomio
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform account takeover, redirect users to malicious sites, or perform actions on behalf of authenticated users.
Likely Case
Attackers could steal user credentials, perform phishing attacks, or deface user profiles.
If Mitigated
With proper input validation and output encoding, the attack would be prevented with minimal impact.
🎯 Exploit Status
Exploitation requires authenticated access and ability to upload SVG files as profile pictures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://classroomio.com
Restart Required: No
Instructions:
Check vendor website for updates. If patch is available, update to the latest version. If not, implement workarounds.
🔧 Temporary Workarounds
Disable SVG uploads
allConfigure the application to reject SVG file uploads for profile pictures.
Modify file upload validation to block .svg extensions
Implement Content Security Policy
allAdd CSP headers to prevent execution of inline scripts.
Add 'Content-Security-Policy: script-src 'self'' to HTTP headers
🧯 If You Can't Patch
- Restrict profile picture uploads to trusted users only
- Implement WAF rules to block malicious SVG content
🔍 How to Verify
Check if Vulnerable:
Check if Classroomio LMS version is 0.1.13. Attempt to upload an SVG file with JavaScript payload as profile picture.Check Version:
Check application version in admin panel or configuration files.Verify Fix Applied:
Verify that SVG uploads are blocked or properly sanitized. Test with malicious SVG payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Multiple failed upload attempts with SVG files
- User accounts uploading unusually large profile pictures
Network Indicators:
- HTTP requests with SVG files containing script tags
- Unusual outbound connections from user browsers after viewing profiles
SIEM Query:
source="web_logs" AND (file_extension="svg" OR content_type="image/svg+xml") AND (url_contains="profile" OR url_contains="upload")