HexBrain

Zaption · Report #112372

XSS during presentation

Validstatus
6upvotes
28 Oct 2017disclosed

How it was found

It is possible for a presenter to xss a viewer Video attached:

Recreation steps

Create publish lesson and start a presentation (join presentation in another browser) Select "Quick question" Open response Insert the question asdf"><img src=x onerror=prompt(1)>

The Javascript will fire on the presenter's side and the viewers side.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original