Executive brief
Skuul is a school management platform used to administer student records and communications. An administrator can upload malicious SVG image files that execute JavaScript code when viewed by any user, potentially stealing credentials, redirecting to phishing sites, or compromising the entire system if an admin account is affected.
Technical details
The vulnerability is stored cross-site scripting (XSS) combined with open redirect, arising from insufficient validation of SVG file uploads in the school editor component (/dashboard/schools/1/edit). SVG files are processed without sanitization and served with default content-type headers, allowing embedded JavaScript event handlers (e.g., onload attributes) and redirection payloads to execute in the victim's browser. An authenticated attacker can upload a crafted SVG; when any user opens the image directly in a new tab, the malicious script executes with the user's session privileges. The exploit is publicly available. No patch is currently known; the vendor was contacted but did not respond.
Affected products
- yungifez Skuul School Management System up to 2.6.5
Timeline
- 2025-11-04: disclosed: Vulnerability reported on GitHub Gist
- 2025-11-30: advisory