Loading HuntDB...

Reflected-XSS on https://www.topcoder.com/tc via pt parameter

Medium
L
Lab45
Submitted None
Reported by laz0rde

Vulnerability Details

Technical details and impact analysis

Cross-site Scripting (XSS) - Reflected
##Summary: I Found an XSS(Reflected) at the URL mentioned and the injected parameter is: pt Steps To Reproduce: 1-go to this URL [https://www.topcoder.com/tc?module=ReviewBoard&pt=1] $$you will recognize that is parameter (pt) is reflecting its value into the page 2- try injecting this parameter with HTML tags or XSS payloads the payloads I used 1-for HTML Injection = <a+href="https://bing.com">LINK</a> 2-for XSS = <script>confirm(1)</script> ## Impact XSS can be used for : 1- Cookie stealing 2- Pishing attacks 3- URL redirection etc....

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Cross-site Scripting (XSS) - Reflected