Stored XSS in a comment field escalating to one-click admin takeover
Comments are stored and re-rendered without encoding. A planted payload runs in every reader's browser — including the moderator's — and is chained to create a new admin account.
The full write-up is locked
Unlock the step-by-step write-up, screenshots and PoC file by purchasing this listing.
Comments are stored and re-rendered without encoding. A planted payload runs in every reader's browser — including the moderator's — and is chained to create a...…
Browse the file tree freely — unlock to download.
-
stored_xss_admin.js 1.3 KB
Cross-site scripting labs
View all labsReviews & Questions
Sign in to ask a question or leave a review.
No reviews or questions yet — be the first.
Listing Details
- Author
- zero_day_phantom
- Published
- 2026-09-13
- Target / OS
- Blog comment system rendering author-controlled HTML
- Category
- Web Apps
- Payout Method
- No preference
Price
0.0330 BTC
≈ $2,145.00
Live Chat
Ask the seller or other buyers a question — mention someone with @handle
No messages yet — start the conversation.
Sign in to join the conversation.