HTML injection in email content during registration via FirstName/LastName parameter

How it was found

Summary:

Hi, I just found an issue when register account in https://mtnmobad.mtnbusiness.com.ng/#/auth/registerUser It allows an attacker to inject malicious text include html code in email content.

Steps To Reproduce:

1. Go to https://uat.id.manulife.ca/mortgagecreditor/register?ui_locales=en-CA.
2. Use the following payload as your First Name:
3. Put the following code as first name:

<h1>Ibrahim</h1>

1. Fill other forms and submit

{F1371367}

Impact

html code injection