HexBrain

U.S. Dept Of Defense · Report #950700

Reflected XSS in https://www.█████/

Validstatus
mediumseverity
23upvotes
29 Sept 2020disclosed

How it was found

Hello Security Team, I would like to report the XSS vulnerability on your system. Steps To Reproduce: Visit the following POC link and move your mouse allover index page: https://www.████/(Z(%22onmouseover=alert%60%60%20%22))/████████/█████.aspx

  1. Tested on firefox browser:

███████ 2.Tested on google chrome browser:

█████████

Impact

An XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim, or for phishing attacks.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original