Skip to content

Stored XSS on Blog that utilized HTML Editor form #422

@Pattharadanai-Sanitjairak

Description

Steps to Reproduce:

  1. Log in with any client account and navigate to "https://lavalite.org/client/job/job" to see the job created by the user.
Image
  1. There will be at least 3 HTML Editor form such as Skills, Descriptions, and Responsibilities. For this demonstration, a field "Responsibilities" will be utilized.
Image
  1. Capture the request and modify the value of the "Responsibilities" to include XSS payload.
Image
  1. Then, view the job and get JavaScript execution.
Image

Note that you can visit my job post (https://lavalite.org/job/test-2) to experience the XSS.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions