Stored XSS On Statement

How it was found

Hello, I've Found a Stored Cross-Site Scripting (XSS) In Gratipay.com .. This XSS is in The Statement, It Happens Because You're Not Sanitizing This From Markdown Malicious Codes.

Steps To Reproduce :

1. Login To Your Account At Gratipay.com
2. Go To Your Profile Page .. And Click Edit Statement
3. Enter Any Of These 2 Payload :

• [notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
• <javascript:alert(document.cookie)>

4. Click Save

Now You'll See 2 Links (See Links.png) .. Click On Any Of These 2 Links And The XSS Payload Will Be Triggered :)

Also This is Dangerous Because The Profile's Statement is Public .. So Anyone Visit The Attaker's Profile And Click On This Malicious Link, XSS Will Be Triggered On His Browser.

Take a Look At My Profile On Gratipay : https://gratipay.com/~geekpero/.

Please Let Me Know If You Need Any Information.

References About Markdown XSS:

• http://stackoverflow.com/questions/1690601/markdown-and-xss
• https://michelf.ca/blog/2010/markdown-and-xss/

Best Regards, Ebram Marzouk