Stored XSS

On the 8th of August 2013, I reported a persistent cross site scripting vulnerability on
The bug is located in the picture upload function of the site. Attackers can basically create an image file with the attacking vectors. For eg, renaming a normal png file to <img src=”” onerror=”javascript:alert(1)”>.png and just uploading it to the site. The site will echo out the name of the image, thus javascript will be executed.

The bug was fixed on 27/08/2013 Bug bounty program includes:
1) A t-shirt.
2) Listed on the site Hall of Fame. –
3) A whitehat hacker badge for your freelancer’s profile. - Global Rank: 534




Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s