Self-XSS on Suggest Tag dialog box

Disclosed: 2022-11-08 19:19:44 By j3rry4unt To xvideos
Low
Vulnerability Details
## Summary: Stored cross-site scripting arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. vulnerable URL : https://www.xvideos.com/video57921571/friend_b._if_d. Vulnerability Description : Application have a add tag functionality when i put java script like <script>alert(1)</script> after that stored XSS vulnerability arise. Step to Reproduce : Step 1 : Go to following URL https://www.xvideos.com/video53284603/b. Note : you don't need an account to do this Step 2 : There is a add tag functionality insert the following information : <script>alert(1)</script> Step 3 : Click the add button Step 4 : you will see a java script popup box showing your domain Check the attached Video POC to see the actual XSS vulnerability ## Impact If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. When the victim accesses the page containing the JavaScript payload, their browser will make a HTTP request to the attacker’s server
Actions
View on HackerOne
Report Stats
  • Report ID: 1761505
  • State: Closed
  • Substate: resolved
  • Upvotes: 14
Share this report