HexBrain

Mavenlink · Report #21150

Flash XSS on swfupload.swf showing at app.mavenlink.com

Validstatus
4upvotes
24 Jul 2014disclosed

How it was found

Hello Security I like to report a XSS that affect all users. This flash XSS can be very dangerous.

Vulnerable URL:

https://app.mavenlink.com/flash/swfupload.swf?movieName="]);}catch(e){}if(!self.a)self.a=!alert(document.domain);//

I attach image of Proof:

Any problem reproducing this bug please let me know.

PS: This Work with all browsers.

Regards.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original