Image upload title section https://3dspaint.com/my/images.php accepts '"' which allows an attacker to place JavaScript into the input field for editing the title of an image displayed in upload section. such an attack could be done by submitting the form from a different website pointed to the file upload file.
- Quotes should be sanitized
- A token, similar to what is used by logout should be used in the form upload submission to ensure the uploaded content is genuinely from the account holder instead of an attacker.
XSS Sample accepted by input as title:" alert(123);
By