Html Injection Stored in edit customers

2022-10-2609:14:15

sk4rl1ght

www.huntr.dev

html injection

edit customers

name field

customer profile

vulnerability

malicious payload

proof of concept

video poc

bug bounty

0.001 Low

EPSS

Percentile

19.4%

JSON

Description

HTML Injection is a vulnerability in which the attacker can inject malicious html content in the webpage.

Proof of Concept

1. Open tab Edit Customers, click Edit customer
2. Inject this payload at field Name: &lt;marquee&gt;TEST TEST TEST&lt;/marquee&gt;. And then click Save
3. Go to the profile page of this customer,  you will see the payload executed.

Video POC: https://drive.google.com/file/d/1PQsCXKOrcZb80xj91vzjIaDGEN562h2Y/view?usp=sharing

0.001 Low

EPSS

Percentile

19.4%

JSON

Related for A3C506F0-5F8A-4EAA-B8CC-46FB9E35CF7A