Stored XSS in class.upload.php
Vulnerability Description
As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the default configuration is used. Developers must be aware of that fact and use extension whitelisting accompanied by forcing the server to always provide content-type based on the file extension. The README has been updated to include these guidelines.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-6551
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Krzysztof Zając (CERT.PL)
Affected Vendor
class.upload.php
View all reports →