BugCrowd Bug Bounty Disclosure: P4 – Stored-xss is working – By agnihackers123
The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct at the time of posting.
Program
Program Information
indeed
Details
Additional Information
- Priority: P4
hello @Indeed I found stored-cross site on the activity which allows an attacker to steal admin account cookies.Users can execute JavaScript code in the context of other users. This is critical when targeted users have high privileges. Attackers are then able to grant themselves the administrator privileges and even takeover the ownership of the New Relic account.The hacker selected the Cross-site Scripting (XSS) – Stored weakness. This vulnerability type requires contextual information from the hacker. They provided the following answers:1)open the url:- [site] 2)Then type the company name is “hello” 3)Then change hello to javascript is entered 4)next button > click 5)Then show the popup message . 6)next page is on then refresh the page cookie is working popup message is show. 7)This is stored XSS.This vuln is stored-xss . Attacker targeted users have high privileges. The hacker selected the Cross-site Scripting (XSS) – Stored weakness.–>>Even attacker can easily get the cookie.Thanks.
Submitted By
Submitter Information
- Hacker Points: 97
- Hacker Accuracy: 85.0%
- Hacker Rank: 1982nd
agnihackers123
