# Reflected XSS in Backend search

Reflected XSS in Moneybird backend search where search_query is injected unquoted into HTML, letting an attacker run JS in a victim's session.

- Payout: hidden
- Severity: high
- Program: Moneybird
- Found by: krankopwnz
- Disclosed: 2016-06-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/136600
- Library page: https://bugbountylibrary.com/r/h1%3A136600
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:xss

**Target:** Backend invoice search endpoint /[id]/search
**Root cause:** The search_query parameter is reflected into the HTML page without being enclosed in quotes, so an attacker can break out and inject event handlers.
**Steps:**
1. Log in and create an invoice with the string `test` in the details so it appears in search results.
2. Send the invoice to a valid email and open the online view link to obtain the account `[id]`.
3. Visit `https://moneybird.com/[id]/search?search_query=test%22%20onclick%3Dalert%28document.domain%29`.
4. Click the search result to trigger the injected `onclick` handler and execute JS.
**How found:** Researcher noticed the search value was not enclosed in quotes in the rendered HTML (screenshot), enabling event-handler injection.
**Exploitation:** Attacker crafts a URL with an injected event handler in search_query and lures a logged-in Moneybird user to it; clicking the result executes attacker JS in the victim's session, enabling phishing redirect, admin addition for account takeover, or marking invoices paid.
**Escalation:** From reflected XSS to full account takeover by adding the attacker as account admin, or financial loss by marking invoices paid.
**Insight:** When a reflected value appears in HTML, check whether it is quoted; unquoted attribute contexts let you inject event handlers like `onclick` without needing to break out of a tag.