Stored XSS on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action

How it was found

Summary:

Hi :) Adding javascript url causes to stored XSS when creating bookmark.

Steps To Reproduce:

Go to https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action . Write javascript:alert(document.domain) on url input and fill other areas. After create, go https://apps.topcoder.com/wiki/display/tcwiki/<TITLE> and when you click the title on this page, XSS will execute.

PoC: https://apps.topcoder.com/wiki/display/tcwiki/powerpuff_hackerone_test {F816754}

Impact

XSS can use to steal cookies or to run arbitrary code on victim's browser.