Zaption · Report #76713

XSS - Gallery Search Listing

Validstatus

1upvotes

12 Aug 2015disclosed

Summary

{URGENT} Global Stored XSS in GALLERY Search result and suggestion drop down and Recent Tours

HI. If you upload video having title with XSS payload. and search for the video, the dropdown listing will execute the payload.

I need not to upload the payload, I utilized already uploaded videos.

You can also execute the payload by just start typing into the search box with "><img

That's it, XSS will be executed.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original