CX Stored_XSS @ badguys/vulnerable/views.py [master]

[kmcdon83]

Stored_XSS issue exists @ badguys/vulnerable/views.py in branch master

Method user_pic at line 35 of badguys\vulnerable\views.py gets data from the database, for the read element. This element’s value then flows through the code without being properly filtered or encoded and is eventually displayed to the user in method user_pic at line 35 of badguys\vulnerable\views.py. This may enable a Stored Cross-Site-Scripting attack.

Severity: High
CWE:79
Vulnerability details and guidance
Internal Guidance
Lines: 42

---

Code (Line #42):

        data = open(os.path.join(base_path, filename), 'rb').read()

---