Cross-Site Scripting via URL on ███████

How it was found

Description:

I discovered a Cross-Site Scripting (XSS) vulnerability on ███ , specifically through the GET method. This vulnerability allows an attacker to inject malicious scripts that could be executed, potentially leading to cookie theft, session hijacking, and other malicious actions.

Payload: <image src=1 onerror=confirm(9706)>

████████ is an official domain from DoD. ██████████ ██████

References

█████

Impact

Exploitation of this vulnerability can lead to severe consequences, including but not limited: Session Hijacking: Attackers can steal cookies and impersonate legitimate users.

System Host(s)

█████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Open the link:

███

Suggested Mitigation/Remediation Actions

Apply context-dependent encoding and/or validation to user input rendered on a page.