Automattic · Report #1554888
Site information's Display Name section vulnerable for XSS attacks and HTML Injections.
Validstatus
lowseverity
11upvotes
16 May 2022disclosed
How it was found
Summary:
Hi,
Greetings. I have found that site information's Display Name section on the try.pressable.com is vulnerable for potential XSS attacks and HTML Injections.
Steps To Reproduce:
- Visit https://try.pressable.com
- Create a new site.
- On the Display Name section, put the XSS / HTML Injection payloads.
- XSS will be triggered/ Injected HTML will be reflected.
XSS Payload: "><img src=x onerror=javascript:alert(document.cookie)>
HTML Payload:
<form action="/action_page.php"> <label for="fname">First name:</label> <input type="text" id="fname" name="fname"><br><br> <label for="lname">Last name:</label> <input type="text" id="lname" name="lname"><br><br> <input type="submit" value="Submit"> </form>Supporting Material/References:
POC Video attached
Impact
Due to these vulnerabilities, attacker can easily divert victims to their malicious site and able to get credentials of victims.