Reflected-XSS on https://www.topcoder.com/tc via pt parameter
Medium
L
Lab45
Submitted None
Actions:
Reported by
laz0rde
Vulnerability Details
Technical details and impact analysis
##Summary:
I Found an XSS(Reflected) at the URL mentioned
and the injected parameter is: pt
Steps To Reproduce:
1-go to this URL [https://www.topcoder.com/tc?module=ReviewBoard&pt=1]
$$you will recognize that is parameter (pt) is reflecting its value into the page
2- try injecting this parameter with HTML tags or XSS payloads
the payloads I used
1-for HTML Injection = <a+href="https://bing.com">LINK</a>
2-for XSS = <script>confirm(1)</script>
## Impact
XSS can be used for :
1- Cookie stealing
2- Pishing attacks
3- URL redirection
etc....
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-site Scripting (XSS) - Reflected