HexBrain

U.S. Dept Of Defense · Report #2521186

Self XSS

Validstatus
mediumseverity
12upvotes
19 Jul 2024disclosed

How it was found

Description: I Have found a Self XSS in https://█████████/ords/f?p=1001:2::::::

  • POC
  1. Go To https://████████/
  2. Go to Search Function
  3. Then Insert a Normal XSS payload like ==<script>alert(document.cookie)</script>==The XSS will fireup

████

Impact

XSS Attacks

System Host(s)

██████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

  1. Go To https://█████████/
  2. Go to Search Function
  3. Then Insert a Normal XSS payload like ==<script>alert(document.cookie)</script>==The XSS will fireup

Suggested Mitigation/Remediation Actions

Remediation By Filtering the user input in search function specially in ==f02 paramter==

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original