Loading HuntDB...

Self-XSS on Suggest Tag dialog box

Low
X
XVIDEOS
Submitted None

Team Summary

Official summary from XVIDEOS

We had a Self XSS on the suggest tag and model dialog box. No real security impact for user.

Reported by j3rry4unt

Vulnerability Details

Technical details and impact analysis

Cross-site Scripting (XSS) - Stored
## Summary: Stored cross-site scripting arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. vulnerable URL : https://www.xvideos.com/video57921571/friend_b._if_d. Vulnerability Description : Application have a add tag functionality when i put java script like <script>alert(1)</script> after that stored XSS vulnerability arise. Step to Reproduce : Step 1 : Go to following URL https://www.xvideos.com/video53284603/b. Note : you don't need an account to do this Step 2 : There is a add tag functionality insert the following information : <script>alert(1)</script> Step 3 : Click the add button Step 4 : you will see a java script popup box showing your domain Check the attached Video POC to see the actual XSS vulnerability ## Impact If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. When the victim accesses the page containing the JavaScript payload, their browser will make a HTTP request to the attacker’s server

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$50.00

Submitted

Weakness

Cross-site Scripting (XSS) - Stored