Loading HuntDB...

Reflected XSS in https://www.██████/

Medium
U
U.S. Dept Of Defense
Submitted None
Reported by nirajgautamit

Vulnerability Details

Technical details and impact analysis

Cross-site Scripting (XSS) - Reflected
Hello Security Team, I would like to report the XSS vulnerability on your system. The `i=` parameter is not escaped properly for URL encoded values. Steps To Reproduce: Visit the following POC link: https://www.████/ViewContent.aspx?con_id_pk=2726&fr=s&i=l9716%27();}]9836&001%3C%2FScript%2F%3E%3CSvg%2FOnLoad%3D(confirm)(1)%3E=1 1. Tested on firefox browser: █████████ 2.Tested on google chrome browser: ██████████ Thanks Niraj ## Impact An XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim, or for phishing attacks.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Cross-site Scripting (XSS) - Reflected