Error Page Text Injection (no compromise)
None
W
WHO COVID-19 Mobile App
Submitted None
Team Summary
Official summary from WHO COVID-19 Mobile App
The text injection is reflected back using Google's standard 404 page. That sanitizes inputs, such that no compromise Is possible.
Actions:
Reported by
spaced
Vulnerability Details
Technical details and impact analysis
Hi team!
I want to report a context spoofing or text injection at http://hack.whocoronavirus.org/ 404 page
Vulnerability Description : The http://hack.whocoronavirus.org/ scope allows users to inject any content on the 404 not found webpage
Vulnerable Location :
http://hack.whocoronavirus.org/TextInjection
Fix 404 error page to a new page which do not allow text content injection
Please let me know if more info needed,
Reference Report : https://hackerone.com/reports/181594
Best Regards,
@jaimaakali
## Impact
Text injection
Report Details
Additional information and metadata
State
Closed
Substate
Not-Applicable
Submitted
Weakness
Misconfiguration