Reflected Query Param XSS vulnerability

[jamaljeantobias]

Description

A Cross-Site Scripting (XSS) vulnerability has been identified in the query parameter ?q=, which can be exploited to execute malicious scripts. This issue could potentially lead to a cross-site scripting attack.

Example:

https://orion.ninja/orion/public/address.html?q=bc1qryhgpmfv03qjhhp2dj8nw8g4ewg08jzmgy3cyx%3Caudio%20src%20onloadstart=alert(%27lol%27)%3E

Solution

Input from the q query parameter should be properly sanitized to prevent reflective XSS attacks. Ensure that special characters are escaped, and untrusted input is validated before rendering it in the web page.

Screen shot