ID H1:240989 Type hackerone Reporter rasi-ras Modified 2017-06-30T04:51:26
Description
while i was testing with your site i found a xss at add the restraunt option
steps to reproduce
1) login to zomato
2) goto add restraunt
3) in the name feild add any xss payload
4)complete it
the restraunt will be sent for verification to the verification team and the xss payload will also be sent to there and get executed there
screen shot added
{"id": "H1:240989", "type": "hackerone", "bulletinFamily": "bugbounty", "title": "Zomato: xss found in zomato", "description": "while i was testing with your site i found a xss at add the restraunt option\n\nsteps to reproduce\n\n1) login to zomato\n2) goto add restraunt\n3) in the name feild add any xss payload\n4)complete it\n the restraunt will be sent for verification to the verification team and the xss payload will also be sent to there and get executed there\nscreen shot added\n", "published": "2017-06-17T12:01:13", "modified": "2017-06-30T04:51:26", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/240989", "reporter": "rasi-ras", "references": [], "cvelist": [], "lastseen": "2018-06-05T21:27:12", "viewCount": 8, "enchantments": {"score": {"value": 1.7, "vector": "NONE", "modified": "2018-06-05T21:27:12", "rev": 2}, "dependencies": {"references": [], "modified": "2018-06-05T21:27:12", "rev": 2}, "vulnersScore": 1.7}, "bounty": 0.0, "bountyState": "resolved", "h1team": {"handle": "zomato", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/000/002/943/dbb71f3e2a0e73fe819c0c2a3e4fbcdd24d138e9_medium.png?1526447675", "small": "https://profile-photos.hackerone-user-content.com/000/002/943/7b54bc7a4a265c47ec0d946a6abf079078b82401_small.png?1526447675"}, "url": "https://hackerone.com/zomato"}, "h1reporter": {"disabled": false, "hacker_mediation": false, "hackerone_triager": false, "is_me?": false, "profile_picture_urls": {"small": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png"}, "url": "/rasi-ras", "username": "rasi-ras"}, "immutableFields": []}