TD Bank: Search input is vulnerable for XSS in qa.td.com and dev.td.com

Summary:

I was able to exploit search input in qa.td.com.

Steps To Reproduce:

Go to qa.td.com and use the search option to reproduce this vulnerability

Supporting Material/References:

{F2152622}

• [attachment / reference]
  Example- https://qa.td.com/ca/en/personal-banking/search?query=test<i>test</i><a onmouseover="alert(document.cookie)"> xxs link</a>&source=1

Impact

1. Hacker can execute malicious codes in victim’s browser
2. Hacker can redirect user to malicious website
3. Hacker can steal victim’s cookies etc.