People who code: we want your input. Take the Survey

Questions tagged [file-upload]

File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.

Filter by
Sorted by
Tagged with
0
votes
0answers
36 views

Should I change the default folder for uploads?

PHP 7 uses the default system folder (/tmp) to store uploaded files. PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to ...
0
votes
0answers
43 views

Server Upload to presigned URL

I am writing a ReST service which enables user to get a tar archive of a set of requested documents. When the request succeeds, the service should upload the file to a pre-signed URL that points to an ...
0
votes
1answer
48 views

Is checking zip content on another PC enough to prevent data leak?

Let's say I have two kind of files on my Windows desktop - first are files that can be published and shared with other people, second kind is confidential and should remain private. To share files I ...
0
votes
2answers
92 views

Path traversal in POST request?

Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request? For example POST [...] ----boundary Content-...
0
votes
0answers
75 views

web shells in IDAT PNG Fragments

I have been doing some research on how a PNG is constructed internally, as well as some articles on a technique to include web shells within the IDAT fragment of a PNG. Researching on the Internet I ...
3
votes
1answer
105 views

Are there risks in user-uploaded .txt files sent as a string to PHP

I'm not sure if this question is within the scope of security.stackexchange or it would be more suitable on stackoverflow. Let me know if needed. I'm wetting my feet in PHP, and I've put together a ...
1
vote
0answers
72 views

How do you check if someone faked the last modified date or not? [closed]

I think one of my students faked the modified date of his word file. He's last modified date was exactly the deadline of 13:00:00 (even the seconds are zero). How do i figure this out?? I want to know ...
0
votes
1answer
63 views

Cryptographic File Storage scheme

First of all,I am new to security as a whole and taking my first formal course on it.So sorry if any major errors are present. I had a scheme for remote file storage as an attempt to use my course ...
2
votes
3answers
97 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
2
votes
1answer
141 views

Prevent Cross Site Scripting but still support HTML file upload

I have a web application where user can upload and view files. The user has a link next to the file (s)he has uploaded. Clicking on the link will open the file in the browser (if possible) or show the ...
2
votes
1answer
654 views

CVE-2017-15580: Getting code execution with upload

I'm testing a target with osTicket 1.7 for CVE-2017-15580. Instead of getting a shell, I'm trying to get the target to make an HTTP request to a temporary end-point. My temporary end-point is https://...
1
vote
1answer
77 views

sudo systemctl running a webserver a security risk?

On linux ami the only way to easily run systemctl for my server is by running sudo systemctl start node In the service: /etc/systemd/system/node.service sudo seems to be mandatory for the 'enable',...
1
vote
1answer
122 views

PHP execution with special characters in the end

I was trying to reproduce this vulnerability: https://www.exploit-db.com/exploits/49294 According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char ...
1
vote
1answer
57 views

CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS?

I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in ...
1
vote
2answers
228 views

Uploading sensitive data, Should I user memoryStorage (buffer) or save and delete file?

I need to save very sensitive data from an Excelfile that the user uploads. The data will then be saved to mySQL. All is done in Node.js. Now I wonder what is the most secure way to upload the file. ...
1
vote
1answer
90 views

XSS injection in the name of a file to be sent

I found a reflected XSS in a POST request that sends a file to the web server. The HTTP POST Request The HTTP 200 OK Response When I want to try to insert document.cookie in the payload, the web ...
1
vote
1answer
96 views

Can an empty uploaded file cause any security issues?

The php.net page on the move_uploaded_file() function contains a User Contributed Note which says, Security tips you must know before use this function : First : make sure that the file is not empty. ...
0
votes
0answers
91 views

Handling file uploads securely in phpmailer/php

I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
0
votes
1answer
795 views

Nodejs-express: file upload vulnerability with txt files?

On nodejs-express, I need a file upload function for my website's bulletin board so that every user can upload and download files for each other. For security reasons, I use npm module 'mmmagic' for ...
1
vote
1answer
135 views

Unrestricted file upload in chat

I am currently doing a bug bounty program and found a possible file upload vulnerability, but I am not so sure about it. The vulnerability is on the chat function. In the chat function, users are ...
1
vote
0answers
308 views

File Upload Vulnerability SVG [closed]

I am currently doing a bug bounty program and was testing the company's file upload functionality. After meddling with the functionality for a while, I was able to change the extension of the uploaded ...
0
votes
0answers
58 views

Risk of Performing Mime Type Detection Before Virus Scan

Should one perform a virus scan on a file (using ClamAV) before attempting to determine it's mime /content type (using Apache Tika), or does it not matter?
1
vote
2answers
151 views

Find path of file on website with randomized string in it

Users have the possibility to upload a sensitive personal file to a specific website. After uploading, only the user himself and the administrator of the website have the ability to download the file ...
0
votes
1answer
41 views

Is it possible for a website to get information about you through its upload feature?

Reddit has a new image upload feature that takes a very long time to work after you click submit-- as long as 30 seconds. It isn't caused by the upload itself; that happens very quickly. I don't know ...
1
vote
1answer
100 views

Encrypting file stores in s3

I am developing a system for storage of medical records. A person could upload image(s) or file(s). Since it is a medical record , it needs to be stored in encrypted form.Also I want that the files or ...
1
vote
1answer
102 views

Can a file upload function be vulnerable without it the file name getting passed?

From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the ...
0
votes
3answers
239 views

Man In The Middle Attack On File Uploads

I am using a web service (call it X) which allows files to be uploaded to AWS S3. The way it works is that an initial call is made to X which then returns a list of file descriptors and also meta ...
2
votes
1answer
2k views

XSS attack on websites that allows JS file upload?

Consider a website example.com that allows users to upload arbitrary JS files, that are then stored on the server and served to visitors with a JS content type. Could an attacker use this to perform ...
1
vote
0answers
140 views

Clickjacking and XSS on file upload input?

I reported a self-xss on file uploader input to a bug bounty company and they said that they will only accept it if i can find a good clickjacking exploit for that input. My question is: Is it ...
0
votes
1answer
289 views

How to validate file content in php?

We have developed an application with contain file upload functionality. We use that application for internal purpose only. We use core php language. We already use the below validations: File ...
3
votes
2answers
1k views

How can I inject real php code into this website?

So I found a file uploader on example.com. The file uploader accepts every file extension and the file is uploaded inside the directory /temp/random-numeric-id.php I tried to upload a php file and ...
5
votes
1answer
1k views

Is it possible to get XSS through uploading an image via the filename?

I just wanted to know if its possible... If i have an image i.e abc.jpeg and i rename it to an XSS vector such as <img src=x onerror=alert(1)>.jpeg will it successfully produce the XSS or is ...
4
votes
2answers
172 views

Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root. I have heard from various sources that trusting uploaded ...
0
votes
0answers
276 views

Can a corrupted image/video become a XSS vector?

Let's suppose that I allow users to upload an image or a video. Obviously, I rename it on the server side. Can an attacker use it to conduct an XSS attack? I show images in this way: <img src="...
1
vote
1answer
401 views

File extensions that should NOT be allowed to be uploaded

I recently built a Downloads Manager that will debut though before I do so I want to know what file extensions I should explicitly disallow from being accepted? Running LAMP/WAMP the most obvious I'...
0
votes
2answers
150 views

Unable to execute PHP, throws 500 error. Able to upload and execute all others

I managed to upload a PHP shell using an upload form with some tweaking. No such restrictions except it renames the uploaded file to md5. But when I tried to execute the shell, It shows a 500 error. I ...
4
votes
2answers
704 views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
1
vote
0answers
44 views

Is it possible to bypass the iOS dialogue for taking pictures to upload existing files?

Scenario: An iOS application that prompts the users to take a picture with their iPhone camera. These pictures (e.g. of documents) will then be uploaded to our server. Is there a possible way for an ...
0
votes
1answer
180 views

Risks of allowing users to upload PDF and XML files to be stored/retrieved from a DB (ASPNET MVC 5)

I'm modifying an ASPNET MVC 5 web site and a requirement is to allow users to upload an XML and PDF file. The XML file will be used to layout text on the PDF based on variables coming from within the ...
0
votes
2answers
463 views

Should you really check user uploaded files for malware/shells?

It's clear that the system has to filter user input. I always thought that the standard is also to check user uploaded files for malware/shells. I'm curious if above is really needed. There is a PHP (...
0
votes
1answer
139 views

Is it possible to exfiltrate a router config file to server using csrf ajax?

the curl commend used to download the file curl "http://192.168.1.1/html/management/downloadconfigfile.conf?RequestFile=/html/management/cfgfile.asp" -H "Cookie: SessionID_R3=dsadwdwqdasdwasdawd" --...
2
votes
1answer
6k views

Why does the file “shell.php.jpg” can execute as a php file but “shell.jpg” cannot?

I am learning about file upload vulnerabilities using DVWA. After cranking the website's security level to High, the website checks both the post request's content type & file extension, so in ...
0
votes
0answers
68 views

Can you trace the path a file upload path without manually executing it?

In a current bug bounty target I have found an unrestricted file upload, it just shoots whatever you give it through a multipart form, that being said I have full freedom of payloads to employ, how ...
2
votes
1answer
147 views

File upload security with PHP - Header to text/plain

I am using PHP to create a small script that uploads images to a server. While going through the PHP documentation, I found a contribution from user CertaiN that gives a very clear example of how ...
1
vote
1answer
52 views

What is the point of hashes when downloading over the same channel? [duplicate]

What is the point of providing shaXXX hashes for downloads of software over say TLS when any attacker that could change the download could have easily changed the hash? Isn't there enough information ...
2
votes
1answer
514 views

Blind XSS Payload for xml file?

I think i may have found a blind XSS. I can only upload xml files that are opened inside the backend. My questions is: How can i turn this payload into a blind xss payload to receive a ping to my ...
0
votes
1answer
157 views

Is this CORS exploitable?

So i was able to upload a html file on a server i'm allowed to test. The file is uploaded on a subdomain of the main server. Knowing that they allow CORS for anything.domain.com, is it possible to ...
0
votes
1answer
137 views

Is this scenario a file upload vulnerability?

I'm testing for file upload and the website has an extension and content type check (png/ jpg). But on intercepting using burp, I'm able to change the content to php code (content-type being image/png)...
0
votes
1answer
287 views

How to spoof file extension when it is appended to the file name every time?

I have an arbitrary file upload vulnerability and I can put my file in any directory. Unfortunately, the serverside script appends ".jpg" ALWAYS to the end and I'm having trouble bypassing it. %00 (...
2
votes
0answers
341 views

Malicious PNG (html with png header)

I found following security notice on Django website: Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...

1
2 3 4 5 6