HexBrain

BTFS · Report #846430

frame injection on bittorrent.com

Informativestatus
mediumseverity
5upvotes
5 May 2020disclosed

How it was found

Hi team, headers.php is injectable.

you can see on IE browsers.

FULL URL : https://www.bittorrent.com/scripts/site/headers.php?_=1586521900793&callback=%3ciframe%20src%3d%22http%3a%2f%2fgoogle.com%2f%3f%22%3e%3c%2fiframe%3e

Impact

fix them

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original