I am creating a bug bounty report for a stored cross-site-scripting exploit that can potentially also cause privilege escalation.
The bug bounty program categorizes Stored XSS
as low criticality and Privilege Escalation
as medium criticality. So for privilege escalation you will get a higher bounty.
This is how the exploit works:
- I (as an
employee
) can insert malicious JavaScript in a page of the web application. - This JavaScript is stored in the database and will be executed at every user that visits that specific page.
- I created a JavaScript payload that gives me the
admin
role as soon as another admin visits the page (basically I'm just replicating a POST call using the admin's session).
Would this exploit be considered Stored XSS
or Privilege Escalation
?