Uber: Stored XSS on developer.uber.com via admin account compromise

Hi, Anyone can add themselves as an administrator on the readme.io uber project that powers developer.uber.com/documentation To replicate this, first fetch https://uber.readme.io/inactiveand and grab Uber's project ID from the source: 578cd33dc27ce20e004e397b Then, using this ID, create a normal...