I'm currently trying to find a vulnerability in a website (yes, I have permission). I found a url with a parameter that, when I change the text in it, that text is set as the name for the background image. Ex. when I change the url parameter text to 'anytexthere', this is what the block of code will look like:
<div style="background-image: url('/images/logo-anytexthere.png')"></div>
Is it possible to exploit this? I've tried unicode brackets and normal HTML code, and the unicode/normal HTML brackets are just removed in the image name.
tldr; url parameter text gets returned into background image name in the page's code, but removes brackets/special characters. How can I exploit this?