Uzbey · Report #19451
IFXSS (image filename XSS) by creating a new Photo Gallery
Validstatus
2upvotes
23 Jul 2014disclosed
How it was found
Hello team! I think I've found a Stored XSS in the Photo Gallery. To reprodruce the possible vulnerability we must:
- Login into our account.
- Go to https://staging.uzbey.com/user/other-albums and click on the "add new album" button.
- Add random values and any image with this name ---> "onerror="alert(1)"a=".jpg
- Publish your gallery.
- XSS! Also, if you click on the image error icon you will obtain the alert. I will attach a few images as a little help for understand my Proof of Concept of the vulnerability. Kind regards.