HTML injection in review content

Disclosed: 2021-12-17 17:44:06 By 0xteles To judgeme
None
Vulnerability Details
Hi Judge Security Team, I found a HTML Injection in review parameter at the https://judgeme-pentest.myshopify.com/products/pentest and at the judge.me ###Steps 1. Go to https://judgeme-pentest.myshopify.com/products/pentest 2. Click on "Write Review" 3. fill in the fields normally. {F1083621} 4. Now, go to your profile review in the judge.me 5. Edit your Review 6. In Review body, enter this payload: ``` <a href=https://google.com/>CLICK HERE</a>``` 7. Save and go to https://judgeme-pentest.myshopify.com/products/pentest {F1083622} 8. Boyaah. {F1083623} ## Impact the attacker can insert HTML codes on the page
Actions
View on HackerOne
Report Stats
  • Report ID: 1036995
  • State: Closed
  • Substate: informative
  • Upvotes: 3
Share this report