Stored SVG File Upload Vulnerability in Salon Booking System

Executive Summary

The Salon Booking System WordPress plugin before version 10.31.11 has a stored XSS and SSRF vulnerability via the Salon REST 'image_url' parameter. Users with the Salon Staff role or higher can provide a malicious image URL that the server fetches without validation. The server stores the response in a public location under an attacker-chosen filename, enabling disclosure of internal resources and execution of arbitrary scripts via malicious SVG files.

Useful 0 Not Useful 0

Detection Guidance

Check if your Salon Booking System plugin version is below 10.31.11. Inspect server logs for unusual image URL requests or unexpected file writes in public directories. Look for malicious SVG files or internal resource disclosures in publicly accessible locations.

Useful 0 Not Useful 0

Impact Analysis

Attackers with Salon Staff access can force the server to read internal resources and disclose sensitive data. They can also upload malicious SVG files that execute arbitrary scripts when accessed, potentially compromising user sessions, stealing data, or defacing the website.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, and failure to maintain confidentiality, potentially leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Salon Booking System plugin to version 10.31.11 or later immediately. Remove any suspicious SVG files or unauthorized files in public directories. Restrict access to the Salon Staff role to only necessary users.

Useful 0 Not Useful 0