Scribd
Upload
22 views

Vulnerability Disclosure Form

Uploaded by

sewahi9783
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
22 views

Vulnerability Disclosure Form

Uploaded by

sewahi9783
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

NCIIPC Responsible Vulnerability Disclosure

1. Reporter’s Details
a) Full Name Ankush Kumar Rajput
b) Email [email protected]
c)Organisation/Company
2. Vulnerability Details (Check mark)
a) Vulnerability Name Reflected Cross-Site Scripting
■ XSS SQLI Stack Overflow
LFI Click Jacking User After Free
b)Vulnerability category XSRF Information Leakage Heap Overflow
Insecure Direct Object Reference Broken Authentication
Memory Corruption Security Misconfiguration
c) Description
(Use Separate Sheet for additional information)
Cross-site scripting (XSS) is a type of web application security vulnerability where an
_______________________
attacker can inject malicious code (usually JavaScript) into a website that is viewed by
3. Type of Vulnerability (Check ■ Web Application Operating System(OS)
other users. The vulnerability arises when a website does not properly validate user
mark) SCADA Any Other
input or encode output, allowing an attacker to inject their own code into the website.
If other please describe in brief Cross site scripting attack can have devastating
When a victim visits the website, the malicious script executes in their browser, often
4. Date when issue found consequences.Code
16/05/2023
(dd/mm/yyyy) injected into a vulnerable application
without the victim's knowledge or consent. This can allow the attacker to steal sensitive
can exfiltrate data or install malware on the user's
__________________________________________________________
1. Nav to https://taxation.punjab.gov.in/

information, such as login credentials or session cookies, from the victim's browser.
2.Go to search bar
3. Enter XSS Payload:(use one by one)

machine .Attackers can masquerade as authorized users


"><script>alert(window.location)</script>

5. Steps to reproduce __________________________________________________________


The attacker can then use this__________________________
information to impersonate the victim or perform other
"><script>alert("Your are Hacked")</script>

via session cookies ,allowing them to perform any action


4.Reflected the popup

6. Whether POC screenshots/files/documents malicious


attached?actions.■ Yes No
allowed by user account.
There are several types of XSS
7. Reported to Affected Organisation? attacks, including reflected,
Yes stored, and DOM-based
No
XSS.
8. Reflected
Affected XSS name
Organisation’s occurs when the injected
Taxation code is reflected back toofthe
CommissionerateDepartment user in
Excise & the
TaxationG
server's
9. Affectedresponse. Stored
Organisation’s https://taxation.punjab.gov.in/products/search/?search=&data%
URL XSS occurs when the injected code is permanently stored on
10.the
Affected
serverOrganisation’s
and executedemail [email protected]
whenever a user visits the affected page. DOM-based XSS
Web Application Client Software
occurs when the attacker is able to modify the DOM (Document Object Model)
11. Vulnerable Product type Server Software Firmware
directly, bypassing server-side validation.
Operating System Hardware
XSS attacks are a serious security threat, and website owners should take steps to
12. Vulnerable Product name & Version Web Application
prevent
13. them.
If reported, This
Email ID includes validating
to whom details sent user input, encoding output, and implementing
[email protected]
strict
14. content
If reported, security
date policies. Users can
when reported also protect themselves by using a browser
16/05/2023
15. Patch extension
released? that blocks known XSS attacks Yes or by disabling JavaScript
No on
16. If patch released, date of patch releaseuntrustedwebsites.
(dd/mm/yyyy)
17. Anonymity (Yes/No)
NO

You might also like