Edmodo Stored Cross Site Scripting

1. Create an new account of teacher and give the first name this " "><img src="x" onerror=alert(1)>" on https://www.edmodo.com/new-user

2. Now go to invite https://www.edmodo.com/home#/invitations here and invite an user/ teacher and when the user get email and click on the accept invite and he will

redirected to a page there the script will be executed

Here is a poc of an invite link : click here

 Reward: T-shirt , coffemug, Stickers and badges  

Seems Edmodo not fixing the issues 

As it not fixed yet if you try to report simple you will get a fucking line in reply "We are aware of this issue"

Previous

Next