HexBrain

Ubiquiti Inc. · Report #226783

HTML Injection on airlink.ubnt.com

Validstatus
lowseverity
9upvotes
22 Jun 2017disclosed

How it was found

Hi I found an html injection vulnerability on airlink.ubnt.com

Steps to reproduce:

First go to: https://airlink.ubnt.com/#/ptp Next go on Save Simulation button and as simulation name put: "><marquee><h1>HTMLINJECTIONHERE</h1></marquee> and save it Now go on Open Simulation button and you will see html being executed :)

Your team should fix it Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original