HTTP HEADER
OFFSEC - Proving Grounds - NEEDLE
·2329 words·11 mins
OFFSEC PG PRACTICE
HTTP HEADER
SVG
XSL
Exploit on port 80 the contact form’s SVG upload function with a special HTTP header to access the medical dashboard. Abuse XSL_PATH during PDF discharge summary generation to inject a custom XSL file and achieve RCE.