FirstBlood-#93XSS using ref Parameter
This issue was discovered on FirstBlood v1

On 2021-05-10, mava Level 2 reported:

Hi zseano, I found a reflected XSS inside Firstblood.


  1. Visit:,(document.domain)//


This vulnerability allows an attacker to execute arbitrary Javascript code.


The parameter must be sanitized correctly.

Best regards,

P3 Medium

Endpoint: /register.php

Parameter: ref

Payload: 1%27AutoFocus/ContentEditable/OnFocusIn=_=confirm,_(1)//

FirstBlood ID: 4
Vulnerability Type: Reflective XSS

The parameter "ref" is vulnerable to XSS on register.php. The developer made use of htmlentities but this is inadequate as the HREF is wrapped in single quotes.

Report Feedback


Creator & Administrator

Nice find ! :)