Reflected XSS in Microsoft Social Forums

Ahmad Halabi

Published On: 11 Apr 2020

LOW VALID

Reflected XSS due to missing server side validation in input `Name`.

Malicious user is able to execute Javascript code on the target website.

Step
1

Navigate to https://social.microsoft.com/Forums/en-US/home and click on Ask a question.

Step
2

In display Name input, type any valid name, click agree to legal terms and click Continue and intercept its request.

Step
3

Modify parameter displayName in burp and type xss payload instead of the name value.

Step
4

Forward the request, and the payload is executed.

Timeline

VALID

Show All Images