-1

So i found a website(lets call it example.com)with a search bar that is not properly sanitized. I was able to pop a alert box with a payload.But i noticed that the URL doesn't change for valid or invalid search query .It always remains www.example.com/search . No query string is being send when i search anything . In other word i cannot pop a alert box on someone else browser by sending them a infected link because URL always remains www.example.com/search.My attacks are only limited to my browser only .

So is this a vulnerability?

here is screenshot of the request enter image description here

user
  • 7,670
  • 2
  • 30
  • 54
shujaat
  • 27
  • 3

2 Answers2

2

XSS can be exploited not just using query string from URL. In your case, this could be HTTP POST request. If this is HTTP POST request, then the vulnerability is perfectly exploitable. The user, however, does not have to follow your direct link to vulnerable website. Instead, you need to create an HTML form with your payload and autosubmit, place it on some webpage and trick the victim to visit that page. Please, provide at least some technical details, so we do not have to guess.

Exploitation example. Replace [host] with real hostname and add/rename parameters in the form. After that submit the form. You can also create JavaScript to autosumbit the form.

<form method="post" action="http://[host]/search/get_search"> <input
type="hidden" name="seach" value='"><img src=x onerror=alert("XSS")>'>
<input type="submit"> </form>
Valery Marchuk
  • 546
  • 2
  • 6
1

It seems like you are speaking about a possible Local XSS vulnerability.

These vulnerabilities take place not at the site, but at user’s local computer, so admins of the sites and web developers often ignore such vulnerabilities. In some cases owners of the sites can do nothing concerning to these vulnerabilities. [source : http://websecurity.com.ua/4219/]

A browser plugin could maybe exploit your found vulnerability to perform some evil

EMX
  • 136
  • 3
  • 2
    A browser plugin doesn't need such a vulnerability to perform some evil, because they can read and modify site content anyway. – Philipp Aug 14 '17 at 13:17