Is it possible to perform a reflected XSS attack via the
The vulnerable code I am imagining might look like this:
I read that it's not possible to programmatically upload a file from a persons computer without their actual interaction (which makes sense, as that would be a giant security issue).
But is it possible to automatically submit an HTML form that PHP would interpret as file upload and thus populate the $_FILES variable, resulting in XSS?
My initial thoughts on this:
The content that is submitted for an input of type file is this:
Content-Disposition: form-data; name="fileinput"; filename="filename.php"\r\nContent-Type: application/x-php\r\n\r\nfile content\n\r\n
The content for eg input of type text is structurally different, looking like this:
Content-Disposition: form-data; name="textinput"\r\n\r\ntext content\r\n
I haven't yet found a way to create a HTML form that sends data of the first type via an input type different than file, and I haven't found a way to pre-populate an input field of type file.