I have a webpage in which Email is given as input. It will then display "your email is firstname.lastname@example.org". I am then changing the email in URL to <script>alert(1)</script> and send tbe request again. The system now displays "your email is <script>alert(1)</script>". Only the display message is like this. Script doesn't seem to get executed. Is this XSS vulnerability or just email validation issue?
There could be many reasons the script is not being executed:
- It is being blocked by a browser filter or a CSP. If this is the case, it would not be displayed on the page, but it would be part of the source code.
- The fake email is properly encoded. If this is the case, you would see it as e.g.
>script<in the source but
<script>in the page.
In general, if you see the payload on the page it is a sign that the filtering is working as it should. If you see it unencoded in the source, it is a sign that you have found an XSS vulnerability. In any case, you are correct that the site in question needs better email validation.