Reflected-XSS on https://www.topcoder.com/tc via pt parameter

Disclosed: 2020-09-04 19:53:55 By laz0rde To lab45
Medium
Vulnerability Details
##Summary: I Found an XSS(Reflected) at the URL mentioned and the injected parameter is: pt Steps To Reproduce: 1-go to this URL [https://www.topcoder.com/tc?module=ReviewBoard&pt=1] $$you will recognize that is parameter (pt) is reflecting its value into the page 2- try injecting this parameter with HTML tags or XSS payloads the payloads I used 1-for HTML Injection = <a+href="https://bing.com">LINK</a> 2-for XSS = <script>confirm(1)</script> ## Impact XSS can be used for : 1- Cookie stealing 2- Pishing attacks 3- URL redirection etc....
Actions
View on HackerOne
Report Stats
  • Report ID: 789652
  • State: Closed
  • Substate: resolved
  • Upvotes: 9
Share this report