Recently, I found an iframe injection vulnerability on a website. This website allows users to create projects and name them. So I successfully injected an iframe on the naming function that can redirect me to a malicious website. But I don't know if the injection is visible to other users or to the administrators, so I don't know if this is a vulnerability.

  • It would seem as though you need to figure out if someone else can view that frame. – schroeder Dec 9 '19 at 14:05
  • It will redirect me to another website when it loads the project's name. But I'm not sure other users can see it also because the each project is private. But I think the administrators might be able to see it, I'm not too sure. – Benassin Dec 9 '19 at 14:09
  • Ok, so it is a successful injection. That's enough to raise an issue with the site. – schroeder Dec 9 '19 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.