11 ms·
DO NOT USE THIS SITE: 1. Create Note with the contents <script>alert(1);</script> 2. Go to link 3. this site is a massive security flaw.
by 28uwedj 5y ago
DO NOT USE THIS SITE:
1. Create Note with the contents <script>alert(1);</script>
2. Go to link
3. this site is a massive security flaw.
- gigamick 5y agoThis is exactly why I posted here. Thank you so much for this feedback. Will fix and let you know.
- teitoklien 5y agoYour laravel php framework debug messages are being exposed to users. Cool site tho, Have a lovely week.
- gigamick 5y agoThis issue now resolved.
- svenfaw 5y agoTo clarify, why is being able to display an alert a massive security flaw in this context?
- retube 5y agoThe alert itself is harmless, but demonstrates that arbitrary javascript - which could certainly not be harmless - can be injected into the page.
- mynameismon 5y agoIt's not the ability to display alerts that is concerning, but rather, the ability to run untrusted Javascript. This was a proof of concept that showed that it has a serious XSS vulnerability
- seedie 5y agoFor detailed information on what XSS is, how it can be exploited and prevented have a look at the OWASP XSS description https://owasp.org/www-community/attacks/xss https://owasp.org/www-community/attacks/xss
- gigamick 5y agoISSUE RESOLVED
- gigamick 5y agoThis is now resolved. Thanks for the feedback!