HTML Injection with XSS possible
Medium
I
Imgur
Submitted None
Actions:
Reported by
malek
Vulnerability Details
Technical details and impact analysis
Hi, I found HTML Injection on imgur.com
Description:
I couldn't get xss but i was able to include videos on my profile and also i was able to redirect users to malicious websites
POC (HTML injection):
go to https://12test.imgur.com (you don't need to login) and you will see external videos and you will see image click on it and you will redirect to http://evil.com,
note that this test page attacker page could be more normal to user,
remeber that it's stored so it will show up when any user viste profile
Suggested fix:
Sanitize all input fields on this page.
## Impact
attacker could redirect users and then execute xss and control them easily, also could include his videos to get views
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-site Scripting (XSS) - Stored