WHO COVID-19 Mobile App · Report #1065830
Error Page Text Injection (no compromise)
N/Astatus
4upvotes
13 Feb 2021disclosed
Summary
The text injection is reflected back using Google's standard 404 page. That sanitizes inputs, such that no compromise Is possible.
How it was found
Hi team!
I want to report a context spoofing or text injection at http://hack.whocoronavirus.org/ 404 page
Vulnerability Description : The http://hack.whocoronavirus.org/ scope allows users to inject any content on the 404 not found webpage
Vulnerable Location :
http://hack.whocoronavirus.org/TextInjection
Fix 404 error page to a new page which do not allow text content injection
Please let me know if more info needed,
Reference Report : https://hackerone.com/reports/181594
Best Regards, @jaimaakali
Impact
Text injection