General Motors · Report #142078
IE search XSS
Validstatus
2upvotes
9 Jun 2017disclosed
Summary
Gm.com website's search function contained a parameter that allowed XSS injection. The vulnerable input parameter has been identified and remediated.
Search DOM XSS reproduced in IE due to non-encoded GET params in this browser. The <script xxx> tag with an extra parameter and without the end tag used to bypass the XSS filter and some JS code restrictions.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.