We have frequently come across cross-site scripting vulnerability (more about XSS) in input fields where HTML special characters are not sanitized. However, these days most developers are aware of this vulnerability and diligently filter user-supplied inputs in forms and URLs.
If the image is not stored in the application then it is considered as a reflected XSS vulnerability.
If the image is getting stored in the application then it is considered as a stored XSS vulnerability.
- Take any application and login to it.
- Go to the profile path.
- In the upload image parameter, insert the image which has the name as below payloads.
“><img src=x onerror=alert(0)>.jpeg
“><img src=x onerror=alert(0)>.png
Now upload an image with the image name as above payload in any application and observe the changes.
Remediation: Sanitize image names before uploading them on to applications.
Research by Jos Rohill