HexBrain
Open on HackerOneSign in

inDrive · Report #2028265

#3 XSS on watchdocs.indriverapp.com

Validstatus
lowseverity
68upvotes
11 Apr 2024disclosed

Summary

And subscribe to our telegram channel with updates https://t.me/indrive_bbp

How it was found

Summary:

Found an XSS

Steps To Reproduce:

  1. Go to https://watchdocs.indriverapp.com/webview/v1/transport-change?phone=██████&token=█████████&service=intercity3&jwt=fw%22%3E%3Cimg%20src=fwa%20onerror=alert(1)%3E

Supporting Material/References:

████

Impact

Execute Javascript on any victim browser

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original