Lucene search
Nyeooo64F3253D-6852-4B9F-B870-85E896007B1AHistoryAug 14, 2023 - 7:06 p.m.
STORED XSS in File Upload
2023-08-1419:06:40
nyeooo
www.huntr.dev
23
stored xss
file upload
extension restriction
0.0004 Low
EPSS
Percentile
14.2%
Description
In the file upload, I can’t upload files with extension like html,php,… but I can upload a file with
extension “inc” and that leads to stored XSS.
Proof of Concept
https://drive.google.com/file/d/1eDE63KXbZLYraDus6hSXwiT_aLDVx9ut/view?usp=sharing
References
Related
prion
prion
Cross site scripting
2023-08-19 01:15:00
veracode
veracode
Cross-site Scripting (XSS)
2023-08-22 10:54:55
github
github
Cockpit Cross-site Scripting vulnerability
2023-08-19 03:32:19
cve
cve
CVE-2023-4433
2023-08-19 01:15:09
osv
osv
Cockpit Cross-site Scripting vulnerability
2023-08-19 03:32:19
CVE-2023-4433
2023-08-19 01:15:09
nvd
nvd
CVE-2023-4433
2023-08-19 01:15:09
cvelist
cvelist
CVE-2023-4433 Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit
2023-08-19 00:59:33