Lab 393 — ShareVault — Stored XSS via File Browser innerHTML

hackadvisor

Task: Express/Node.js file sharing platform renders uploaded filenames via innerHTML without sanitization; admin bot reviews reported files. Solution: stored XSS via malicious filename with img onerror handler, exfiltrate admin's non-HttpOnly cookie by uploading a new file with stolen data encoded in the filename via FormData+fetch.