Eternal · Report #419731

[www.zomato.com] Blind XSS in one of the Admin Dashboard

Validstatus

61upvotes

3 Dec 2018disclosed

Summary

@sandeep_hodkasia identified a Blind XSS vulnerability that fired in one of our admin dashboard.

@sandeep_hodkasia added "><script>alert(0);</script> [XSS Hunter was used in this case] in address field while placing an order.
XSS triggered when one of our support agent viewed the order details.

Thanks @sandeep_hodkasia for helping us keep @zomato secure :)

Best, Prateek

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original