HTML Injection in E-mail Not Resolved ()

Disclosed: 2022-07-19 09:11:30 By thewikiii To acronis
Medium
Vulnerability Details
## Summary On this report " https://hackerone.com/reports/1536899 " You closed the report and changed the status to Resolved. But it's Not Resolved The Bug It's Still there ## Steps To Reproduce 1.Please register at https://www.acronis.com/en-us/products/cyber-protect/trial/#registration with the victim's email. 2. Inject "First Name" field with HTML tags, for example: "/><img src="x"><a href="https://evil.com">login</a>. 3.Check the email inbox, HTML tags will be executed. "Your Acronis Cyber Protect trial starts today!" Proof of Concept: F1774045 ## Impact HTML injection into emails is dangerous! * Your users are at risk when a hacker is able to take control of the emails that your applications send, but what's especially dangerous is that the emails will be coming from your company email address. * When a malicious email comes from your company email, it looks a lot more legitimate.
Actions
View on HackerOne
Report Stats
  • Report ID: 1600720
  • State: Closed
  • Substate: resolved
  • Upvotes: 23
Share this report