Description
The web application supports file uploads and Acunetix was able to upload a Java Applet (.class/.jar) file. If a web browser loads a Java applet from a trusted site, the browser provides no security warning. If an attacker can upload a CLASS/JAR file with an applet, the file is executed even if the web page, which embeds the applet is located on a different site. An attacker could use a file upload function to build an XSS attack using active content.
Remediation
Restrict file types accepted for upload: check the file extension and only allow certain files to be uploaded. Use a whitelist approach instead of a blacklist. Check for double extensions such as .php.png. Check for files without a filename like .htaccess (on ASP.NET, check for configuration files like web.config). Change the permissions on the upload folder so the files within it are not executable. If possible, rename the files that are uploaded.
References
Related Vulnerabilities
WordPress Plugin WordPress Slider Block Gutenslider Cross-Site Scripting (5.1.5)
WordPress Plugin Product Addons & Fields for WooCommerce Cross-Site Scripting (18.3)
WordPress Plugin Computer Repair Shop Cross-Site Scripting (1.0)
PHP preg_replace used on user input
WordPress Plugin WP Easy Gallery Cross-Site Scripting (4.1.4)