I recently discovered a DOM cross-site scripting issue while testing PayPal. The process was straightforward — inserting this payload into the URL was enough:
#"><img src=/ onerror=alert(2)>Impact#
The DOM executed the JavaScript straight from the URL. This vulnerability would have affected all registered PayPal users. The report was closed as a duplicate, but I wanted to write it up anyway.
Disclosure#
Here’s the PoC I sent to the PayPal bug bounty team.
— Patrik Grobshäuser
