Description

The application allows file uploads where both the filename and content are not properly filtered, creating a risk of client-side JavaScript execution.

The checkValidFileName() function (from Security.php) only performs superficial checks on characters and extensions, but does not prevent uploading .html files containing JavaScript code:

Codepublic static function checkValidFileName($fileName,$activeTraceHack=true, $forAttach
ment=true) {
// Checks for invalid characters and accents
if (! preg_match('#^[^/?*:;{}\\<>|"]*\.?[^/?*:;{}\\<>|"]+$#',
pq_nvl($fileName))) {
if($activeTraceHack) traceHack("filename $fileName containts invalid
characters");
}
// Minimal extension filtering
if ($forAttachment) {
$ext = pq_strtolower(pathinfo($fileName, PATHINFO_EXTENSION));
if (pq_substr($ext,0,3)=='php' or $ext=='htaccess') {
$fileName .= '.projeqtor.txt';

}
}
return $fileName;
}

The code does not block .html files and does not validate content, allowing malicious script injection through uploaded files.

Attack Vectors

• Network access: Remote
• Authentication required: Low
• User interaction: Required (victim loads malicious content)
• Scope: Changed (script executes in the victim’s browser context)
• Type: Stored
• Injection point: File

Steps to Reproduce (PoC)

1. Create a malicious HTML file:

Code<script>alert('XSS via file upload');</script>

2. Upload the file via the form:

   • Endpoint: /tool/uploadImage.php, /tool/saveAttachment.php, or equivalent interface.
   • The .html file is accepted despite containing script code.

3. Client-side execution:

   • Open the file in a browser or access its public URL.
   • The JavaScript executes, confirming the vulnerability.

Impact

Successful exploitation of this vulnerability may lead to significant impacts, including:

• Session compromise and hijacking
• Execution of actions on behalf of the user (CSRF-like behavior)
• Redirection to phishing websites
• Interception of user inputs (e.g., credentials)
• Modification of application interface integrity

Possible Mitigation

1. Strict extension validation: block .html, .htm, .js, etc.
2. Secure renaming:

Codeif (in_array($ext, ['html','htm','js'])) {
$fileName .= '.txt';
}

3. Server-side content filtering and storage outside the web root.

Authors

• Yassine Damiri
• Noé Susset