Lab 48 — PulseDesk — Stored XSS via Widget postMessage DOM Injection

hackadvisor

Task: Support ticketing platform with embeddable chat widget using postMessage API and URL hash auto-configure, both feeding innerHTML XSS sink; HTML sanitizer allows iframe with relative src. Solution: Craft base64-encoded XSS config (avoiding + and = characters) in iframe src hash fragment, inject via ticket description, admin bot triggers DOM XSS, cookie exfiltrated via same-origin ticket reply POST.