HexBrain

Informatica · Report #203912

Stored XSS via Discussion Title and Send as Email attribute in [marketplace.informatica.com]

Validstatus
highseverity
9upvotes
8 Apr 2017disclosed

How it was found

POC

  1. Under "Your Stuff" choose to "Create a Discussion/Ask a question"
  2. Choose a space to submit your discussion/question. Any space will do.
  3. Title your discussion with the payload "><img src=x onerror=alert(1)>
  4. Choose "Post message" to publish.
  5. View the message as any user. Under "Actions" choose to "Send as Email"
  6. Observe XSS poc alert box"

Please let me know if you have any questions.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original