webPromedium
Lab 56 — DataPulse — XXE to SSRF via SVG Avatar Upload
hackadvisor
Task: DataPulse analytics dashboard with SVG avatar upload processed server-side via libxmljs2 with entity resolution enabled. Solution: XXE injection in SVG file to read local files, discovered .env config at /app/data/.env revealing confidential report path, then read flag from /app/data/.reports/confidential.txt.
$ ls tags/ techniques/
xxe_injectionsvg_xxelocal_file_readenv_file_disclosureconfig_enumeration
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 59 — NetPulse — RCE via Command Injection in Network Diagnostics— hackadvisor
- [web][Pro]Lab 90 — InsightDash — SSRF via Avatar Proxy Endpoint— hackadvisor
- [web][Pro]Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API— hackadvisor
- [web][Pro]Lab 53 — TeamPulse — SQL Injection via WebSocket Employee Lookup— hackadvisor
- [web][Pro]Lab 49 — PixelVault — Stored XSS via Malicious SVG Upload— hackadvisor