Reflected XSS — Arbitrary JavaScript Execution and Session Cookie Exposure

Summary#

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the domain search functionality.

The application reflects user-controlled input into the response without proper output encoding, allowing an attacker to execute arbitrary JavaScript code in the context of the affected domain.

Steps to Reproduce#

1. Navigate to the domain search page:

https://0000.com/

2. In the "Search for a domain" field, enter the following payload:

<img src=x onerror=alert(document.domain)>

3. Submit the search request.
4. The injected JavaScript is executed in the browser under the context of the affected domain.

To demonstrate JavaScript execution, the following payload can also be used: