Friday Fun Pentest Series - 23 - Stored XSS - alegrocartv1.2.9

Description

- The application lacked output encoding and as a  result of that was vulnerable to Stored XSS

Stored XSS #1:

Steps to Reproduce:

1. Login as demonstrator account and visit "Customers" > "Newsletter"
2. In "Message" use the following XSS payload

<iframe srcdoc="<img src=x onerror=alert(document.domain)>"></iframe>