Stored XSS due to Unrestricted File Upload in star7th/showdoc


Reported on

Mar 13th 2022


Stored XSS via uploading files in .aspx format.

Proof of Concept



Steps to Reproduce

1.Login into
2.Navigate to file library (
3.In the File Library page, click the Upload button and choose the poc.aspx
4.After uploading the file, click on the check button to open that file in a new tab.

XSS will trigger when the attachment is opened in a new tab.



An attacker can perform social engineering on users by redirecting them from a real website to a fake one. a hacker can steal their cookies etc.

We are processing your report and will contact the star7th/showdoc team within 24 hours. 2 years ago
Ajaysen R submitted a
2 years ago
2 years ago


This is a PHP service and will not execute ASPX files. So it doesn't affect.

2 years ago


No, I tried, and it was implemented.

star7th validated this vulnerability 2 years ago
ajaysenr has been awarded the disclosure bounty
The fix bounty is now up for grabs
star7th marked this as fixed in v2.10.4 with commit 785225 2 years ago
Ajaysen R has been awarded the fix bounty
to join this conversation