Mars · Report #1921606
Stored XSS via ' profile ' at ███
Validstatus
mediumseverity
16upvotes
23 Jun 2023disclosed
Summary
A Cross-Site Scripting (XSS) vulnerability was present in the ██████' field on the user profile page. The vulnerability arises from the improper sanitization of user input, allowing attackers to inject malicious scripts that execute within the victim's browser context when the profile is viewed.
How it was found
hi team i found stored xss on profile
- Go to registration page (██████)
- Verified your account.
- Go to login page and login your account.
For the fastly test, use this credentials to login (my test account)
█████████ For Attacker
email: █████████ pass: Password ████ For Victime
email: █████████ pass: password
After login i change animal name to payload xss .. i open victime account and i put attacker profile url so i succeeded.
██████████
Impact
Stored Cross Site Scripting which attacker can execute malicious javascript payload.