HexBrain
Open on HackerOneSign in

GSA Bounty · Report #615840

Blind Stored XSS In "Report a Problem" on www.data.gov/issue/

Validstatus
mediumseverity
$300bounty
21upvotes
7 Aug 2019disclosed

How it was found

Step To Produce :

  1. Open : https://www.data.gov/issue/
  2. fill "Issue Title" and "Description" With XSSHunter Payload
  3. XSS Fired In https://labs.data.gov/crm/admin/report/662445

Impact

Can steal admin cookies

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original