XSS in Email Input [intensedebate.com]
Medium
A
Automattic
Submitted None
Actions:
Reported by
ahmd_halabi
Vulnerability Details
Technical details and impact analysis
## Summary:
I found an XSS in Email input. This input is not sanitized like other inputs allowing user to execute xss payloads.
## Platform(s) Affected:
https://www.intensedebate.com/edit-user-account
## Steps To Reproduce:
1. Navigate to your account.
2. In email address, add the below payload next to your email.
`"><img src=x onerror=alert(document.cookie);>`
## Supporting Material/References:
██████
## Impact
Reflected XSS, An attacker can execute malicious javascript codes on the target application (email input specifically). It is highly recommended to fix this one because it is found in sensitive input (email).
Kind Regards.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-site Scripting (XSS) - Generic