HexBrain

Veris · Report #133744

XSS in Asset name

Validstatus
2upvotes
13 May 2016disclosed

How it was found

Found one XSS iin asset name

Steps To Reproduce

  1. Create Any member at https://sandbox.veris.in/portal/members/

  2. Add that member in any group at https://sandbox.veris.in/portal/groups/

  3. Create an Asset named <script>alert(1);</script> at https://sandbox.veris.in/portal/assets/

  4. Now go back to members https://sandbox.veris.in/portal/members/ and click on the symbol shown in screen shot for any of the member {F88735}

you should see an XSS popup!

Regards Ashish

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original