HexBrain

X / xAI · Report #100931

xss in link items (mopub.com)

Validstatus
$560bounty
14upvotes
5 Jul 2016disclosed

How it was found

Hi,

1)go link items and select text,tile 2)enter image and give click url as javascript://%0a%0dalert(document.cookie) 3)xss pop's up it is not a self xss because admin can invite many people to his inventory and there sessions can be hijacked. regards prashanth dups team :)

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original