Blind stored xss in demo form

Summary

Through Upserve's demo request form, @paresh_parmar found a blind XSS in a 3rd party package for Upserve's CRM system. While the CRM system and 3rd party package are out of scope for our program, we decided to reward @paresh_parmar for his work in bringing this issue to our attention.

• Endpoint where i added payload get a demo form.
• XSS executed in [redacted] company
• In [redacted] company account , upserve is using 3rd party tool which is use for marketing stuff, so vulnerable app was 3rd party tool. ( i also contact 3rd party, but no response from them) can't disclose name of tool because its use widely by many companies.
• a report was closed as informative by the triage team. they said they couldn't reproduce issue and also it's 3rd party site so its out of scope
• I contact [redacted] company. that company contact upserve and told them about issue, and finally they reopen this report ,and fixed it . (3rd party tool released fix )