Infogram: User account blocking by Internal Server error

If you send a language=en in https://infogram.com/api/users/me user be forever get an Internal Server error EVEN AFTER re-logining: https://youtu.be/AxYa11lEiWA I idk why does hackerone can't upload this video so I uploaded this video privately to the youtube! In this video, I'm trying to relogin...

Infogram: possibility to create account without username

hi , infogram.com doesn't allow us to go next untill we give name of our account but i bypassed that. i am able to create an account without any name, just by modify response field. steps:- 1. create new account , when you reach page where you have to give your name. 2. give name and intercept th...

Infogram: New team invitation functionality allows extend team without upgrade

Privilege escalation vulnerability was found, which allowed to bypass the limitation of team members...

Infogram: Persistent XSS in share button

Persistent XSS in "Share" button was found: 1. In custom link field for "Share" button add: ". 2. Share the infographic publicly, navigate to its public URL and click the "Share" button. 3. See that pop-up window activates...

Infogram: Bypass insecure password validation

Hi Team, Summary: Registration is checking the password creation if the password is insecure , but the password reset page was not doing the same validation, so when i input an insecure password using the password reset, the validation on the password creation can be bypass because the password...

Infogram: Stored XSS On Wordpress Infogram plugin

Hello Team, There is a Stored XSS Vulnerability On Wordpress Infogram plugin. Wordpress version : 4.5 Infogram plugin version : 1.5.1 After installing wordpress and infogram plugin. I created a project to infogram with the following name " and I Created a simple report. Then I go back to my...

Infogram: Stored XSS in content when Graph is created via API

Summary It is possible for an attacker to insert javascript code into Graphs by creating a project via the API Steps to reproduce Login Go to API Settings Copy your Key + Secret Go to API Documentation Download one of the official libraries I chose JAVA In the "main" method add the Key + Secret y...

Infogram: No Email Verification

There should be an email verification when creating a new user. B/c i can make an account from others email address for example: [email protected] Now when the real person, how own this email address cant make an account with his email address...

Infogram: Javascript Payload reflected Back in Report Embed Code

1Create new Report template 2Spoof its name with payload " My Report alertdocument.cookie;div id=" 3Visit Back to your library list https://infogram.com/app//library 4Select The Created report and click view on web,Click the Share Button 5Copy & embed the code somewhere in html file you ll triage...

Infogram: Multiple xss on infogram templates

Hello Team, There is a multiple xss on some templates. Payload used : "...

Infogram: XSS when Shared

Introduction XSS on an embedded piece of code that, when shared, may make it seem as if it was infogram.com that was doing the malicious act. Proof of Concept 1. Create an account 2. Create a project titled "scriptalert1;" 3. Click on share Here's an example of the share embedded code:...

Infogram: HTML injection

hi team ... i found HTML i on https://infogram.com/app//library step .. 1- go to https://infogram.com/app//library 2- choose Report Templates . 3- Use Report Classic 4- click to editdata 5- edit cell Employee ID 5- payload hacked hacked hacked 6-execute HTML .. POC .. video on attached...

Infogram: XSS on infogram.com

Hello, There is a XSS on Report templates. Free templates : Report Classic When we modify the values of table we can put XSS Payload. Payload used : " "/...

Infogram: Report Design Critical Stored DOM XSS Vulnerability

Hi Team, Another XSS vulnerability in report designer but this one is critical. Problem Point Report's Overview Table Report Creation Url https://infogram.com/app/edit/e7b161f1-f708-48e5-bab7-de9887ae202a Sample Data Click for Detail Sample URL https://infogram.com/report-classic-1g57pr0g3xdvp01...

Infogram: No notification on Password Change

Hi Team, Description : I noticed there is an issue with password reset functionality user is not receiving notification when he reset password. Even though when user change password through profile, not getting an email notification. Issue: user not always gets a notification about password chang...

Infogram: XSS on Report Classic

hi team ... i found XSS on https://infogram.com/app//library step .. 1- go to https://infogram.com/app//library 2- choose Report Templates . 3- Use Report Classic 4- click to editdata 5- payload //" “alertdocument.cookie 6-execute XSS and which you edit data XSS stared...

Infogram: Application Vulnerable to CSRF - Remove Invited user

POC: 1. Login to the application with a business account. 2. Go to Manage teams, where we can send invites to a team member. Send a Invite to a team member 3. After the invite is sent to a user, the admin has option to Remove User. 4. While trying to remove the user, capture the request in burp ,...

Infogram: Sensitive information is publicly available

During the analysis it was found that some sensitive information like ip is available on this url .https://infogram.com/ip/...

Infogram: Outdated jQuery Version

During analysis, it was observed that the application is using outdated jQuery version i.e. 1.11.2...

Infogram: Stored XSS in the Custom Logo link (non-Basic plan required)

Description Hello. Recently i contacted with Infogram, and requested trial of the Business version to test some features, which was unavailable in the Basic version. I discovered the stored cross-site scripting issue in the Custom Logo link. F232084 There was some URL checks in place, but i was...