Slack · Report #187410

Store XSS

Validstatus

highseverity

44upvotes

1 Jan 2017disclosed

How it was found

Hello Team.

I found a Store XSS. Where the company name is the vulnerable to XSS. If you give this below XSS script as Company name, you will get the XSS pop up after the login in message option where it'll randomly generated at the message room. “><IMG SRC=x onerror=javascript:alert("XSS-by-Imran")>

Here is the POC: https://youtu.be/dqrH2WhIgtk

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original