quran / quran.com-frontend-v2

https://quran.com
GNU General Public License v3.0
452 stars 199 forks source link

XSS Vulnerability #528

Closed a8256ee12b64 closed 5 months ago

a8256ee12b64 commented 2 years ago

You can add HTML tags in the Local Storage and it won't be filtered by the website before showing it.

Key: quran-store-bookmarks Value: {"<script>document.body.innerHTML='<h1>Hacked</h1>'</script>":"/"}

Result: image