Uzbey · Report #23010

XSS in 3rd party plugin (not affecting Uzbey's users)

Validstatus

3upvotes

2 Nov 2014disclosed

How it was found

Uzbey currently using a 3rd party solution from sharethis.com to share user's album.

It is possible to use this function as a medium to attack sharethis.com's users that using Uzbey service.

1- Create album using XSS payload 2- Share the album using Email function (letter icon) 3- XSS will execute.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original