Often Misused: file upload error

Sign in to answer this question.

• 

  Shuvojit Halder11y agoPosted Jul 1, 2015, 3:07 AM

  Accepted answer

  Ypu can do

   

   

  string filename = Path.GetExtension(FileUpload1.PostedFile.FileName);

  FileUpload1.SaveAs(HttpContext.Current.Server.MapPath(foldername) +"\"+ fileName);

   
• PG

  paresh gugale11y agoPosted Jul 1, 2015, 2:56 AM

  Upload.aspx.cs, line 47 (Often Misused: File Upload)

   Fortify Priority: Medium Folder Medium 

  Kingdom: Input Validation and Representation 

  Abstract: The function Button1_Click() in Upload.aspx.cs calls SaveAs() on line 47. Permitting users to upload files can allow attackers to inject dangerous content or malicious code to run on the server.

   Sink: Uploal.aspx.cs:47 SaveAs() 

          string filename = Path.GetFileName(FileUpload1.PostedFile.FileName);

         

          FileUpload1.SaveAs(Server.MapPath("foldername/" + filename));

          

          con.Open();
• 

  Prasham Sabadra11y agoPosted Jul 1, 2015, 2:54 AM

  Hi,

   

  Please have a look at following article once, very well explained the some solutions to prevent this kind of errors or attacks

   

  https://www.owasp.org/index.php/Unrestricted_File_Upload  
• 

  Rajeesh Menoth11y agoPosted Jul 1, 2015, 2:42 AM

  Hi,

   

  Can you post the error ?