Stored Xss ( Cross Site Scripting ) in Moment.me

Stored Xss ( Cross Site Scripting ) in Moment.me

 

Hello Friends This is my First blog writeup or post.

And in this post i am gonna tell you about the stored xss bug in moment.me.

Actually i did not expect that i can find vulnerabilities ( loop hole in security of the website) as so many security researchers have already reported bugs to moment.me and were acknowledged by moment.me with a digital certificate.

The day i woke up opened my laptop , connected to internet and started surfing through facebook posts .....and i saw a post of one of my friend "Amine" he reported bugs to moment.me and was acknowledged by a badge of honor .....

So i immediately navigated to moment.me and thought what type of bug should i exploit...? And the days back i like to exploit xss bugs ....so started hunting xss bugs in that website....

Proof of Concept (PoC) :

[1]. I signed up in that website and went into Details tab and entered xss payloads : "><img src=x onerror=javascipt:alert("xss")>

And the website did not sanitize the xss payloads and i saved it

[2]. I navigated to appearance tab and i entered xss payloads  :

[3]. And this was last move .... :) 3:) i navigated to Albums tab and clicked on Add albums button and my script got executed :

[4]. After reloading the page BOOM!!!! my script got executed and the pop-up popped up 3:)

And i was like :

And even this is my first bug in the field of hacking
Moment.me sent me the Digital Certificate within a day

Hope you liked it :) ;) have a great day
hope the best (y)