Lab 231 — PagePulse — XSS via Web Cache Poisoning

hackadvisor

Task: Content analytics platform with caching layer; query parameter reflected unsanitized in HTML meta tags but excluded from cache key. Solution: Web cache poisoning via unkeyed query string to inject XSS, then trigger admin bot visit to exfiltrate non-HttpOnly flag cookie through same-origin API endpoint.