Khan Academy · Report #83604

Html injection on khanacademy

Validstatus

5upvotes

14 Dec 2015disclosed

How it was found

There's an HTML Injection Vulnerability exists in khanacademy . Affected parameters "linkSuccess="

Steps to reproduce:

first open your account on khanacademy. 2.enter the link in the url box. http://khanacademy.org/settings/account?linkSuccess= 3.set any text after "=" (eg. http://khanacademy.org/settings/account?linkSuccess=hello world) 4.hit enter . 5 you see......

i have attach a poc video in this report.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original