ExpressionEngine · Report #20221
Cross Site Scripting (Stored)
Validstatus
2upvotes
30 Sept 2014disclosed
How it was found
Occurred in the URL : https://store.ellislab.com/billing After adding a product to the cart proceed to add the billing and card information and in the card fields give your card details respectively and in the fields
- First name
- Last name
- Street Address
- Apt/Suite/#
- City.
Give the following payload : "><img src=x onerror=prompt(0);> and click on Place Order and there it goes 5 stored XSS will appear