Uber · Report #125059
Self-XSS Vulnerability on Password Reset Form
Duplicatestatus
5upvotes
13 Jun 2016disclosed
How it was found
Hello Security Team,
I have found Third Security Vulnerability on your website :- https://partners.uber.com/
Vulnerability :-"XSS vulnerability on password reset time :)"
My Payload is this :- >'>"><img src=x onmouseover =prompt(document.domain)>
Following This Reproduce Steps :)
- send password reset link on your email id
- open password reset link
- set as password this payload :- >'>"><img src=x onmouseover =prompt(document.domain)>
- Continue and click on show password XSS got triaged
Youtube Video Link :- https://youtu.be/UpUbq58LV9Y
I request to you sir if this is not valid then close as informative please sir, am just reported this issue because this XSS on password reset time please sir:)
If valid then I hope, you will FIX ASAP
Regards, Pratik Panchal