Informatica · Report #203912
Stored XSS via Discussion Title and Send as Email attribute in [marketplace.informatica.com]
Validstatus
highseverity
9upvotes
8 Apr 2017disclosed
How it was found
POC
- Under "Your Stuff" choose to "Create a Discussion/Ask a question"
- Choose a space to submit your discussion/question. Any space will do.
- Title your discussion with the payload
"><img src=x onerror=alert(1)> - Choose "Post message" to publish.
- View the message as any user. Under "Actions" choose to "Send as Email"
- Observe XSS poc alert box"
Please let me know if you have any questions.