[Write-Up] Stored Cross Site Scripting in "World Beyblade Organization"

Hey, this is my first write-up on my blog, today I am going to share the PoC of Stored XSS (Cross Site Scripting) vulnerability, which I've found in WBO (World Beyblade Organizaion)

So, the bug existed in "Tumblr option for adding your tumblr blog to your profile on WBO!

It was not filtering the user input, and as a result we were able to execute JavaScript in your profile page! As you can see in the screenshot below.

STEPS TO REPRODUCE:

• Go to your User control panel
• Click on edit profile
• And this code: "><img src="x" onerror=prompt(document.domain)>
• Go to your profile, the xss will pop-up

Moreover, the input was stored, so the site was also defaceable, and everytime a user opens the page, the xss will pop-up!

Thanks for Reading!

VIDEO PoC:-

Share this

Share on FacebookPlus on Google+