POST Based Reflected XSS on Login

FirstBlood-#119 — POST Based Reflected XSS on Login
This issue was discovered on FirstBlood v1

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-05-10, smhtahsin33 Level 3 reported:


Hello,
I Found a Reflected XSS on http://firstbloodhackers.com:49394/login.php?action=login.
Steps To Reproduce:

Visit http://firstbloodhackers.com:49394/login.php?goto=javascript:confirm``;
Enter Valid Credentials
Tap on login, and the alert will be popped up.

Impact:
Injection of malicious JS code

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: http://firstbloodhackers.com:49394/login.php?action=login

Parameter: ?goto=

Payload: javascript:confirm``;

FirstBlood ID: 14
Vulnerability Type: Reflective XSS

The parameter "goto" is vulnerable to XSS on login.php. The web application fails to filter the javascript URI upon redirecting

BugBountyHunter