Stored XSS via ' profile ' at ███

Disclosed: 2023-06-23 14:59:03 By 0xs4m To mars
Medium
Vulnerability Details
hi team i found stored xss on profile 1. Go to registration page (██████) 2. Verified your account. 3. Go to login page and login your account. For the fastly test, use this credentials to login (my test account) █████████ For Attacker email: █████████ pass: Password ████ For Victime email: █████████ pass: password After login i change animal name to payload xss .. i open victime account and i put attacker profile url so i succeeded. ██████████ ## Impact Stored Cross Site Scripting which attacker can execute malicious javascript payload.
Actions
View on HackerOne
Report Stats
  • Report ID: 1921606
  • State: Closed
  • Substate: resolved
  • Upvotes: 15
Share this report