HexBrain

Eternal · Report #145246

Stored Cross site scripting

Duplicatestatus
9upvotes
28 Jun 2016disclosed

How it was found

hello zomato team,

i have found a stored xss on https://www.zomato.com/beirut/garcias-dbayeh-metn

step to reproduce

1- write a review by this payload : >'>"><img src=x onmouseover =prompt(document.domain)> 2-click edit 3- xss will excute :)

video : https://youtu.be/ibawEBPQs3g

best regaeds, Amir Ezat.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original