Veris · Report #133744
XSS in Asset name
Validstatus
2upvotes
13 May 2016disclosed
How it was found
Found one XSS iin asset name
Steps To Reproduce
-
Create Any member at
https://sandbox.veris.in/portal/members/ -
Add that member in any group at
https://sandbox.veris.in/portal/groups/ -
Create an
Assetnamed<script>alert(1);</script>athttps://sandbox.veris.in/portal/assets/ -
Now go back to members
https://sandbox.veris.in/portal/members/and click on the symbol shown in screen shot for any of the member {F88735}
you should see an XSS popup!
Regards Ashish