Recently, I found a stored cross site scripting vulnerability in a rather large website, but I am not sure if it is dangerous or worth reporting. On this website, there is a resource section that is accessible by logged in users, where they can post certain personal resources that can be used only by themselves. It is not possible to share a resource to another user. Also, there is also a portfolio page, where you can make things public. I found two possible vulnerabilities, but I am asking to see if they are dangerous at all.
Stored XSS : The first vulnerability includes the resources page, where you can post a link. The first time you post the link, it is sanitized, and you cannot get anything useful through. Upon editing the link, though, it is not sanitized, and you can easily insert a
<script>alert(1)</script> or a
The Problem : The problem with this vulnerability, is that it only works when I view the portfolio page, because the resources page in the iframe is only accessible to me. The resource page link is possible to access using only one session cookie (my session cookie) when viewing it. Is there any way that I could pass my cookie into the iframe so that the xss vulnerability could be viewed on any user? Could I pass the cookie as a http header (there is a 'Set-Cookie' header). If I use an iframe, can the child access the parent's cookies? Is this even a vulnerability / can I make it work? Thanks so much!