X / xAI · Report #28150
Cross site scripting on ads.twitter.com
Validstatus
7upvotes
16 Oct 2014disclosed
How it was found
Hi,
Steps to reproduce the issue:
-
Go to this link https://ads.twitter.com/accounts/XXXX/tweets where is XXXX is your account id.
-
Click on Compose Tweet option and enter "><svg/onload=prompt(123);>
-
Click on "Tweet" Button now.
You will prompt dialog box with "123" in it.
POC video: https://www.dropbox.com/s/64li7wv7gq2brlz/twitterxss.mov?dl=0
Please fix this.
Best Regards, Anand Prakash