Mail.ru: XSS in delivery club

Reflected XSS via GET parameters of AJAX method due to invalid content-type for JSON data. On the moment of the report delivery-club.ru was not covered by bug bounty program...

delivery-club.ru XSS vulnerability

Vulnerable URL: https://www.delivery-club.ru/ajax/suggest?q=m4imb%3Cimg%20src%3da%20onerror%3dalert1%3Eclarj Details: Description| Value ---|--- Patched:| Yes, at 17.08.2017 Latest check for patch:| 17.08.2017 12:27 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank...