Localize · Report #786301
Stored XSS in Name of Team Member Invitation
Duplicatestatus
lowseverity
15upvotes
6 Feb 2020disclosed
How it was found
hello team i have found an stored in add team member
Step to reproduce
- Go to https://localizestaging.com/organization/team?filter=all
- click on add team member
- On the name, enter payload: </script><svg onload=alert(document.domain)>
- and in the email add your victim email
- when he join the team the xss will trigger. {F701271}
now victim , can't logout, he can't do anything in his account
best regards @moodiabdoul3
Impact
the victim can nothing in his account