Starbucks · Report #768345

Korea - Reflected XSS on https://www.istarbucks.co.kr/app/getGiftStock.do via "skuNo" and "skuImgUrl" parameters

Validstatus

mediumseverity

8upvotes

18 Aug 2020disclosed

Summary

rexvuz discovered the endpoint at https://www.istarbucks.co.kr/app/getGiftStock.do was susceptible to a reflected cross-site scripting vulnerability via the skuNo and skuImgUrl parameters.

@rexvuz — thank you for reporting this vulnerability and for confirming the resolution.

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original