I have a site, let's call it
parent.com, that embeds a third party plugin from
child.com in an iframe. I have found a XSS vulnerability on
The embedded page from
child.com contains a form that POSTs to another page on the same domain. I can exploit the vulnerability by submitting the form. I intercept the POST request with Burp, and insert my payload into it. The payload is then executed.
My problem is that the payload runs inside the iframe on the
child.com domain. My goal is to compromise
parent.com (in order to win a bug bounty). Is it possible to use this vulnerability to accomplish that somehow? For example, can I somehow make the form submit to