# Stored XSS in photos_user_map.gne

Group name was unescaped on Flickr's legacy photos_user_map.gne map page, letting a stored XSS payload run and delete a victim's account via CSRF-token iframe.

- Payout: $3,263
- Severity: high
- Program: Flickr
- Credited: keer0k
- Disclosed: 2022-05-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1534636
- Library page: https://bugbountylibrary.com/r/h1%3A1534636
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:rest technique:chained technique:recon vuln:csrf vuln:xss

**Target:** Legacy .gne map page (photos_user_map.gne) rendering group names
**Root cause:** The legacy photos_user_map.gne page rendered the group name into HTML without escaping, so a stored group name containing `</script><img src=x onerror=alert(1)>` executed as script.
**Steps:**
1. Recon legacy paths with gau, enumerate `.gne` endpoints
2. Create a Flickr group with name `</script><img src=x onerror=alert(1)>`
3. Visit `https://www.flickr.com/photos_user_map.gne?path=&nsid=14815413%40N21&mode=group&lang=en&tag=1` and click the group-name button to trigger the payload
4. Weaponize: inject script that writes a hidden same-origin iframe to `/account/delete`
5. On iframe load, scan anchors for `h=` CSRF token, click it to reach `?step=1&h=TOKEN`
6. After 500ms, click `confirm` checkbox and `Submit` to delete the victim's account
**How found:** Used gau to enumerate legacy `.gne` paths, injected the payload into many fields including group name, then clicked through each `.gne` page; the group-name button on photos_user_map.gne triggered the XSS.
**Exploitation:** Stored payload executes in www.flickr.com origin; since X-Frame-Options permits same-origin framing, the script iframes /account/delete, reads the CSRF token from the `h=` link via contentDocument, clicks through the two-step deletion flow, and deletes the victim's account.
**Insight:** Legacy `.gne` endpoints surfaced via gau still render user-controlled fields (group names) unescaped; enumerate old page versions and test every stored field against them, then chain same-origin iframe access to CSRF-token-protected destructive actions.