I'm pentesting this web application developed in ASP.NET.
I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this:
<img src="../attachments/open.aspx?Key=10350&ute=20069" />
So I have the possibility to upload any kind of file and they will be requested as images, but I don't have any control on the image path.
Also I know that the image is uploaded as binary in the database, so is not phisically in the webserver.
Is there a way to exploit this? I haven't found anything yet.
EDIT: since my question has been put on hold and I don't know how to narrow down my question, can someone suggest me what kind of vulnerability should I look for? What course of action would an expert take?