Using the PUT method, you can upload any file on the server. This can be used to perform Cross Site Scripting (XSS). Today, I have performed this attack, so replying here with my experience. How you do this is explained below.
PUT /XSS.html HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT)
(Input your XSS script here)
The server responds back with a 201 status code which says “file was created successfully”.
HTTP/1.1 201 Created
Date: Mon, 05 May 2014 12:28:53 GMT
Server: Apache/2.2.14 (Win32)
Now we can try to access this uploaded XSS.html file in browser. As soon as you access this page, you get an XSS pop-up.
Likewise, this can be further exploited to perform Command Injection as well, though I haven't tried this yet. If application uses XML, then XML External Entity attack can also be performed. Havent done this too yet. Directory Traversal attack may be possible, too.