✓ Exploit successful — a stored comment on this board contains unescaped markup — it executes in the browser of everyone who views it, including the admin moderator at /admin/comments (stored XSS).
Discussion board — course #101
aliceAre the slides posted yet?
ta_mikeYes — under Week 3.
Objective Store a comment that executes in other users' browsers — including the admin moderator's (stored XSS).
💡 Show hint
Post a comment containing <script>…</script> or <img src=x onerror=…>. Then view /admin/comments as the moderator would.
FlawComment bodies are stored and later rendered raw.
FixEncode on output; sanitise stored HTML; add a CSP.