Yes, your SVG can easily be altered to execute arbitrary code. You have a reflected XSS vulnerability right there.
When you have
<svg width="<?php echo $_GET["name"];?>" height="100">
<circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>
Set name
be equal to 40"> <script> alert('XSS'); </script></svg> <svg width="100
. The resulting XML will now be
<svg width="40"> <script> alert('XSS'); </script> </svg><svg width="100" height="100">
<circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
</svg>
And thus, we have injected a <script>
tag and can execute arbitrary code on the client side.
SVG is no "dead image", it's alive. You can have script tags in there, even "g" objects have "onload" handlers. There is a whole bunch of attacks that can be carried out when you control an SVG that the user shows.
Also read "The Image that called me back" for more info. There are lots of more attack vectors described there.
So, to make your application safe, you must ensure that you cannot break out of the quotes.
width="$UserInput"
in the inner text or is it an attribute? Anyways, without sanatization, we can ofcourse manipulate it. Set$userinput
equal to12" </svg> <script> alert('XSS'); </script> <svg> width="12