Self-XSS on Suggest Tag dialog box
Low
X
XVIDEOS
Submitted None
Team Summary
Official summary from XVIDEOS
We had a Self XSS on the suggest tag and model dialog box. No real security impact for user.
Actions:
Reported by
j3rry4unt
Vulnerability Details
Technical details and impact analysis
## Summary:
Stored cross-site scripting arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.
vulnerable URL : https://www.xvideos.com/video57921571/friend_b._if_d.
Vulnerability Description : Application have a add tag functionality when i put java script like <script>alert(1)</script> after that stored XSS vulnerability arise.
Step to Reproduce :
Step 1 : Go to following URL https://www.xvideos.com/video53284603/b.
Note : you don't need an account to do this
Step 2 : There is a add tag functionality insert the following information : <script>alert(1)</script>
Step 3 : Click the add button
Step 4 : you will see a java script popup box showing your domain
Check the attached Video POC to see the actual XSS vulnerability
## Impact
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
When the victim accesses the page containing the JavaScript payload, their browser will make a HTTP request to the attacker’s server
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$50.00
Submitted
Weakness
Cross-site Scripting (XSS) - Stored