She would need to entice the user into typing into a form and the user would need to type at least as many characters as there are in the name of the file the malicious user wanted to upload. The malicious user could only recover one file per form submission. The vulnerability would only enable the malicious user to upload files. She could not add, change or delete files on the user s computer. This would enable a malicious web site operator, under certain conditions, to insert the name of a file into a form, and then upload it.
Web forms can gather input through many different methods via text boxes, drop-down boxes, etc.
For example, a web site might need to offer a way for customers to provide feedback about the site s products. When the user submitted the form, the file would be uploaded to the web site. By design, only the browser user should be able to enter text into the box that indicates the name of the file to upload. However, this vulnerability provides a way for a web application to bypass this restriction and put text of the web site operator's choice into the field that specifies the file name. There is no capability via this vulnerability for the malicious web site operator to list the files on the visiting user s computer and then select one.