Self -Xss to Stored Xss On Zendesk

Here before the poc i want to say that , i just implement the functionality of the site to lead self xss to stored one

Tagret: https://developer.zendesk.com

Steps:

1. go to https://developer.zendesk.com/account and under account information put payload in organization filed payload : <script>alert(1)</script>
2. Here Its an self-xss right ?
3. Now i am going to explain how i made it a stored one
4. After this Zendesk Team marked It as N/A
5. Then i remember that there is a autocomplte on on that organization filed 
   
6. Then I Fired my Burp and capture the request made  that form  then i saw https://developer.zendesk.com/autocomplete.json?name= is making request of organization from the db (all types organization are already saved in db, which you used before )
7. So as i previously saved the organization name as <script>alert(1)</script> i started typing from <script and the
   autocomplete.json?name= make request to db to retive the organization name started with <script then the payload executed
   

Then i made video poc and sent to Zendesk and report reopened and fix and finally bounty $$

 

Previous

Next