XSS security issue
Reported by https://www.bof.nl
Dear Security Team, I noticed Post based XSS vulnerability on kies.bof.nl. There is Poll creation functionality on the website Which is consists of 3 steps. Vulnerability on the 2nd step which is poll date section.Time field is vulnerable.
Vulnerable url: https://kies.bof.nl/create_date_poll.php?type=date
Vulnerable parameter: horaires2[]
Payload: " onmouseover="alert(document.domain)" bad="
Replication steps:
- go to https://kies.bof.nl/create_date_poll.php?type=date
- field 1st step and press "Go to Step 2" button
- on the 2nd step , choose any date from the calendar.
- type above payload to the time 1, time 2, time 3 field.
- Press "Next" Button
- On the 3rt step, Press "Back" Button
- Move mouse over the time field.
- Popup will be prompted with "kies.bof.nl"
Security Impact: Session Hijacking, Redirection to the Malicious website and many more.