Inflection · Report #239762

XSS at https://app.goodhire.com/member/GH.aspx

Validstatus

mediumseverity

14upvotes

21 Feb 2018disclosed

Summary

Unescaped input from a URL parameter in the checkout flow was being used as a JavaScript variable for determining what cart contents to render. By manipulating the URL parameter, the researcher was able to execute arbitrary JavaScript on the page.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original