XSS Reflected at https://sketch.pixiv.net/ Via `next_url`

Disclosed: 2022-03-23 01:19:37 By find_me_here To pixiv
Medium
Vulnerability Details
Hi, I Found XSS Reflected at https://sketch.pixiv.net/ Via Success URL ##Follow Me :) ##Steps : 1. Open the URL below: https://sketch.pixiv.net/resign_request/success?next_url=javascript%3Aalert%2F**%2F(document.domain) 2. Pop ups appear :) ## Impact If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform
Actions
View on HackerOne
Report Stats
  • Report ID: 1503601
  • State: Closed
  • Substate: resolved
  • Upvotes: 60
Share this report