Uzbey · Report #17287
email field doesn't filtered against XSS
Validstatus
2upvotes
8 Jul 2014disclosed
How it was found
Hi, Pre-configuration, create new contact in Gmail with mail a"><img src=y onerror=prompt(...);>
- Go to Invites.
- Click on Invite Gmail Friends.
- Accept the pop up.
- XSS will activate on the email field.
Few issues continue during this issue:
- When you click on this email address you get failure on AJAX functionally.
- If you try to do the same scenario I describe the system throw Error The website encountered an unexpected error. Please try again later.
Sasi