Uber · Report #145289
Self-XSS in Partners Profile
Duplicatestatus
1upvotes
7 Jul 2016disclosed
How it was found
Hi , I have found an XSS stored vulnerability in the page paterns uber profile edit. the vulnerability in the vat number. Steps to reproduce:
- Login to partners.uber.com
- Go to a page https://partners.uber.com/profile/
- In the vat number enter a payload xss : "><img src=x onerror=alert(0)> "><img src=x onerror=alert(0)> <script>alert(0)</script>
- save
thank you, please tell me if the bug has been fixed.