Cross Site Scripting (XSS) Through File Upload SVG

preview_player
Показать описание
#bugbounty #bugbountytips

File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. There is an XSS (cross-site scripting) vulnerability present in the file upload functionality. Someone can upload a file with a malicious filename, which contains JavaScript code, which would result in XSS.
Рекомендации по теме
Комментарии
Автор

Fake. The file hosting application has been modified to do this. If it had not been, then the link for the hello.png image would either download it and display a blank page or display the image itself. In either case, it wouldn't try to present the file as an html page (as shown in the video).

agentred