{"id":159,"date":"2022-11-29T13:53:00","date_gmt":"2022-11-29T06:53:00","guid":{"rendered":"https:\/\/n45ht.or.id\/blog\/?p=159"},"modified":"2025-10-14T22:48:29","modified_gmt":"2025-10-14T15:48:29","slug":"stored-xss-on-laporbugid-injecting-payloads-through-profile-images","status":"publish","type":"post","link":"https:\/\/n45ht.or.id\/blog\/stored-xss-on-laporbugid-injecting-payloads-through-profile-images\/","title":{"rendered":"Stored XSS on LaporBug.id: Injecting Payloads through Profile Images"},"content":{"rendered":"\n

LaporBug.id<\/strong> is a Bug Bounty Platform based in Indonesia. If you want to know more about LaporBug.id, visit their website at https:\/\/laporbug.id<\/a>.<\/p>\n\n\n\n

I spent a few minutes exploring LaporBug.id and examining the various URLs, parameters, and forms available on the site. During my reconnaissance, I came across a feature that allows users to upload a profile image on the following page:<\/p>\n\n\n\n

URL:<\/strong>
https:\/\/laporbug.id\/myprofile\/edit<\/a><\/p>\n\n\n\n

Here\u2019s the process I followed to identify and exploit a potential vulnerability:<\/p>\n\n\n\n

On this page, there is a form to upload a profile image. I started by uploading a regular image file.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next, I decided to experiment with the file extension. Instead of uploading a common image file (e.g., .jpg<\/code> or .png<\/code>), I changed the extension of my image file to .html<\/code>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Despite changing the extension to .html<\/code>, the file was uploaded successfully without any errors. This indicated that the server wasn’t properly validating or restricting file extensions, which is a potential security risk.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I tried uploading several sensitive extensions such as:<\/p>\n\n\n\n

    \n
  • .php<\/code><\/li>\n\n\n\n
  • .php5<\/code><\/li>\n\n\n\n
  • .phtml<\/code><\/li>\n\n\n\n
  • .PhP;.png<\/code><\/li>\n\n\n\n
  • .php%00.png<\/code><\/li>\n<\/ul>\n\n\n\n

    However, the server blocked these attempts and didn\u2019t allow these files to be uploaded.<\/p>\n\n\n\n

    Although the server blocked dangerous extensions, it allowed the .html<\/code> extension. This gave me an opportunity to craft a Stored XSS payload.<\/p>\n\n\n\n

    To inject the payload, I used ExifTool<\/strong> to manipulate the image metadata. I inserted the following XSS payload into the image:<\/p>\n\n\n\n

    <\/circle><\/circle><\/circle><\/g><\/svg><\/span>