Eternal · Report #200351
XSS in flashmediaelement.swf (business-blog.zomato.com)
Validstatus
mediumseverity
4upvotes
17 Jun 2017disclosed
How it was found
Hello Team
Description:- business-blog.zomato.com is vulnerable to reflected XSS that stems from an insecure URL sanitization process performed in the file flashmediaelement.swf
POC:- https://business-blog.zomato.com/wp-includes/js/mediaelement/flashmediaelement.swf?%#jsinitfunctio%gn=alert%60xss by dem0n%60
{F154224}
Fix:-
Update to WordPress to latest
Regards:- Santhosh