CVE-2025-13784: 
PHP vulnerability analysis and mitigation

CVE-2025-13784 is a stored Cross-Site Scripting (XSS) and Open Redirect vulnerability in the yungifez Skuul School Management System, affecting all versions up to and including 2.6.5. The flaw resides in the SVG File Handler component accessible via the /dashboard/schools/1/edit endpoint, where unsanitized SVG files can be uploaded and later executed in victims' browsers. It was publicly disclosed on November 30, 2025, with a proof-of-concept published by researcher Zeeshan Khan. The vulnerability carries a CVSS v3.1 base score of 4.8 (Medium), requiring high privileges and user interaction (Feedly, GitHub PoC).

The root cause is improper neutralization of input during web page generation (CWE-79) combined with improper control of code generation (CWE-94). The application's Edit School section accepts SVG file uploads without validating or sanitizing embedded scripts, event attributes (e.g., onload, onmouseover), or enforcing a safe Content-Type header. Because SVGs are served directly from the server without sanitization, any embedded JavaScript or redirect payload executes in the victim's browser when the file is opened — for example, via "Open Image in New Tab." Exploitation requires an authenticated attacker with high privileges (e.g., admin) to upload the malicious SVG, after which any user who opens the file triggers the payload (GitHub PoC, Feedly).

Successful exploitation enables stored XSS and open redirect attacks against any user who views the malicious SVG, including administrators, students, teachers, and parents. Attackers can redirect victims to attacker-controlled phishing or malware sites, execute arbitrary JavaScript in the victim's browser context, and potentially steal session cookies or credentials if the SVG is served under the same origin. If an administrator account is compromised, the impact extends to all platform users, risking reputational damage and loss of trust in the school management platform (GitHub PoC, Feedly).

A public proof-of-concept exploit was published on GitHub by researcher Zeeshan Khan on November 4, 2025, and indexed by NVD on December 5, 2025. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.028% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by the requirement for high-privilege authentication and user interaction (GitHub PoC, Feedly).

1. Authentication: Log in to the Skuul application as an administrator at /login.
2. Navigate to vulnerable endpoint: Go to /dashboard/schools/1/edit (the Edit School section).
3. Craft malicious SVG: Create an SVG file containing an embedded JavaScript payload or open redirect, for example:

<svg xmlns="http://www.w3.org/2000/svg" onload="window.location='https://evil.com/'">
  <rect width="100" height="100"/>
</svg>

4. Upload the SVG: Use the school logo/image upload field to submit the malicious SVG file.
5. Trigger execution: When any user (admin, student, teacher, or parent) opens the uploaded image in a new browser tab, the browser executes the embedded script, redirecting them to the attacker-controlled site or running arbitrary JavaScript in their session (GitHub PoC).

• Network: Outbound HTTP redirects from the Skuul server to unexpected external domains (e.g., evil.com) originating from SVG file requests; unusual GET requests to uploaded SVG files from multiple user accounts.
• File System: Presence of SVG files in the upload directory containing <script>, onload=, onmouseover=, or window.location strings; SVG files with unusually small dimensions but large file content.
• Logs: Web server access logs showing requests to /dashboard/schools/1/edit followed by repeated accesses to the uploaded SVG file from different user sessions; HTTP 302/301 redirect responses originating from SVG file URLs.
• Process/Application: Unexpected JavaScript execution errors or CSP violation reports in browser console logs related to SVG content served from the application domain (GitHub PoC).

No official patch has been released by the vendor (yungifez), who did not respond to the researcher's disclosure. Until a fix is available, administrators should disallow SVG file uploads entirely or sanitize uploaded SVGs using libraries such as DOMPurify or sanitize-svg before storage. Additional mitigations include serving SVGs with a Content-Disposition: attachment header to force download rather than inline rendering, implementing a strict Content Security Policy (CSP) to restrict script execution, and limiting administrative access with multi-factor authentication. Organizations should monitor upload directories for malicious SVG content and audit access logs for suspicious activity (GitHub PoC, Feedly).

The vulnerability received limited industry attention, consistent with its medium severity and niche affected product. It was tracked by standard vulnerability aggregators including VulDB, ENISA EUVD, INCIBE-CERT, and Tenable, and briefly noted on Bluesky via automated CVE feeds. The vendor did not respond to the researcher's disclosure, which was noted as a concern in the public write-up (Feedly).