I have a webpage in which Email is given as input. It will then display "your email is [email protected]". I am then changing the email in URL to <script>alert(1)</script> and send tbe request again. The system now displays "your email is <script>alert(1)</script>". Only the display message is like this. Script doesn't seem to get executed. Is this XSS vulnerability or just email validation issue?
3
-
1If the script doesn't get executed maybe the payload is not good..maybe this is not an XSS issue, how's your DOM arranged ?– Soufiane TahiriCommented Feb 28, 2019 at 14:10
-
It is a third party website and I am testing it. Not sure about DOM. Will check that.– user2455158Commented Feb 28, 2019 at 14:20
-
inspect it as html if possible , it might just be html encoded so its safe to display– BokisCommented Feb 28, 2019 at 15:05
Add a comment
|
1 Answer
There could be many reasons the script is not being executed:
- It is being blocked by a browser filter or a CSP. If this is the case, it would not be displayed on the page, but it would be part of the source code.
- The fake email is properly encoded. If this is the case, you would see it as e.g.
>script<in the source but<script>in the page. - It is being inserted into the DOM with JavaScript using a safe method like
textContent.
In general, if you see the payload on the page it is a sign that the filtering is working as it should. If you see it unencoded in the source, it is a sign that you have found an XSS vulnerability. In any case, you are correct that the site in question needs better email validation.
