A user browsing the images randomly of a secure web application finds out a pop up that says “Hello!”. The user is using Internet Explorer for browsing images.
-
Cross-site Scripting.
-
Cross-site Scripting by MIME sniffing.
-
Log Injection.
-
Identity Theft.
Internet Explorer's MIME sniffing feature can treat images as HTML if they contain HTML-like content. An attacker could upload an image file with embedded script content; when IE processes it as HTML due to MIME sniffing, the script executes (Cross-site Scripting by MIME sniffing). Regular XSS requires a script tag, log injection targets logs, and identity theft involves stealing personal information.
Some browsers (notably older Internet Explorer) perform MIME sniffing — inspecting file content rather than trusting the declared Content-Type header — to guess how to render a resource. If an attacker uploads a file that is technically an 'image' by extension/MIME type but contains embedded HTML/script content, IE's MIME sniffing can misidentify it and render/execute the embedded script in the context of the site, producing an unexpected popup like 'Hello!' while the user is just browsing images. This is Cross-site Scripting by MIME sniffing — a specific, historically documented IE vulnerability class, distinct from standard reflected/stored XSS (no injected URL parameter or stored script field is described here) and unrelated to Log Injection or Identity Theft.