lokibhardwaj PHP-Code-For-Unlimited-File-Upload Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in lokibhardwaj PHP-Code-For-Unlimited-File-Upload versions prior to commit 124fe96324915490c81eaf7db3234b0b4e4bab3c. The issue arises in the file /f.php, where the argument 'h' can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the '/f.php' file with a crafted 'h' parameter that includes the desired script payload. The injected script will be executed, demonstrating the cross-site scripting vulnerability.