Starbucks · Report #531042
Reflected XSS in https://www.starbucks.com/account/create/redeem/MCP131XSR via xtl_amount, xtl_coupon_code, xtl_amount_type parameters
Validstatus
mediumseverity
43upvotes
13 Nov 2019disclosed
Summary
zayn1337 discovered that the endpoint at https://www.starbucks.com/account/create/redeem/MCP131XSR was vulnerable to a reflected cross-site scripting vulnerability.
@zayn1337 — thank you for uncovering this vulnerability, your patience while we followed up on the issue and for confirming the resolution.
How it was found
HI,
Summary: Reflected XSS Description: the parameters are complementary to each other Platform(s) Affected: my browser firefox 52.7.3
Steps To Reproduce:
- go to https://www.starbucks.com/account/create/redeem/MCP131XSR?xtl_coupon_code=1&xtl_coupon_code=81431&xtl_amount=0.0&xtl_amount_type=DOLLAR_VALUE
- change parameter
xtl_amount_typeto </script><svg/onload=alert()>>note:if you go enter this the payload not work but!!!!! you changextl_coupon_codeandxtl_amount` payload will work - change
xtl_coupon_codeandxtl_amountto any think
Supporting Material/References:
{F464214}
How can the system be exploited with this bug?
The attacker can execute JS code.
How did you come across this bug ?
change xtl_coupon_code and xtl_amount payload will work
In this bug the parameters are complementary to each other
Recommendations for fix
In this bug the parameters are complementary to each other try to retreat
Impact
- The attacker can execute JS code.