CVEs-PoC/2021/CVE-2021-26699.md

CVE-2021-26699

Description

OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used.

POC

Reference

• http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2021/Jul/33
• https://seclists.org/fulldisclosure/2021/Jul/33

Github

No PoCs found on GitHub currently.