Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Could XSS lead us to the Local File Include or Remote File Include? I read article that it's possible to upload shell via XSS vulnerability, but I still have no idea how it had been achieved.

share|improve this question
Please provide links to the articles you mentioned. – Hendrik Brummermann Jun 6 '12 at 12:57
up vote 1 down vote accepted

Server-side "remote file inclusion" vulnerabilities are sometimes classified as XSS, because they include server-side script from another site. I suggest not to use this classification because most people associate XSS with JavaScript.

That being said, JavaScript XSS may lead to a server side remote include: Assume there is a function which allows administrators to upload plugins. If there is a XSS vulnerability somewhere in the same domain, an attacker can use it, to gain access to the administrator-session and upload arbitrary program code, such as phpshell.

Furthermore the upload function might not even be intended for plugins but just for images. It might not properly validate the upload, and put the uploaded files into a directory in which .php files are executed, for example.

This might either be a bug because the developers were not aware of the risks, or just a dangerous omission based on the assumptions that only trustworthy people upload files. That's were the XSS vulnerability comes into play.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.