[Numinous]

█▬█ Mediafire Persistent XSS [Tut] █▬█

Mediafire.com suffers from a persistent XSS vulnerability within its file uploads.

After a user has uploaded their file they can change the title of the file.

To something like

Code

<script>alert('Chetan')</script> .txt

Check these Examples:-
http://www.mediafire.com/?37q503pdsda7k3r
OR
http://www.mediafire.com/?kkbrj6h6ou7v335
OR
http://www.mediafire.com/?c49cukaveu195wv
OR
https://hackforums.net/showthread.php?ti...id14941431
OR
https://hackforums.net/showthread.php?ti...id14939567

[simply_mark]

What are the pros and cons of using this trick mate? I don't understand, sorry I'm noob. :)

[Galithiel]

What are the pros and cons of using this trick mate? I don't understand, sorry I'm noob. :)

You can steal premium accounts or make them download another thing, etc...

[Pseudonym]

Good job finding that. And also nice sharing with other people, I bet that most people wouldn't do it for various reasons whether to want it misuse personally or report it to the admin. On the other hand, haven't you written in other thread something about being ethical?

[conan_1]

Seems a good job for me, I have to stop sqli and give some time to xss xD

[Middle]

Haha wow nice find!

This could come in handy :D

[Anti-trust]

█▬█ Mediafire Persistent XSS [Tut] █▬█

Mediafire.com suffers from a persistent XSS vulnerability within its file uploads.

After a user has uploaded their file they can change the title of the file.

To something like

Code

<script>alert('Chetan')</script> .txt

Check this Example:-
http://www.mediafire.com/?37q503pdsda7k3r

yeahh good job rep +1 Enjoy 😊

[Ph03.nix]

Wow, awesome find. Thank you very much for this share 🤭

[Basics.]

That's quite a find, though I think it has been posted before but nontheless good job.

[D-gravE]

Good job finding that. And also nice sharing with other people,

[ryonan]

that's so cool man, gonna give this a try

[ericosman]

nice this will become helpfull :)

hope it wont get fixed

[Numinous]

Thanx 4 all of you for being stay here and Now i wanna ask one question

How we protect a site from XSS???

[SuburbanInsanity]

So if you upload a java drive-by jar, you could run it using another random upload directly on mediafire? interesting.

[Layfon]

hmmm is <script> the only thing we can do>?