Medium
Cross-Site Scripting
CampusConnect discussion board stored XSS
A course-registration discussion board. A comment is stored raw and reviewed by a scheduled advisor bot.
PentestingHere Academy
Official Academy lab
- Attempts
- 5
- Solves
- 2
- Published
- 25 Aug 2026
Scenario
CampusConnect's discussion board lets students post comments. An academic-advisor bot periodically reviews new posts. Comments are stored and rendered without escaping.
Goal
Get a stored payload to execute in the advisor bot's session. The advisor opens every new comment in their own browser; any alert(), confirm() or prompt() that fires there sends the flag straight to the banner on your page.