Import avatar from URL
Point the importer at an image URL and the server downloads it for your profile. This app runs on a cloud instance.
The import source is pinned to this site and
locked in the form. Only by overriding the url field in the request body (via an intercepting
proxy) can it be aimed elsewhere.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.