DeskPilot — Stored XSS via Form Hijacking (CSP Bypass)

hackadvisor

Task: Customer support platform renders HTML ticket descriptions unescaped inside a reply form containing admin's API token; CSP blocks scripts but lacks form-action directive. Solution: Inject invisible submit button with formaction attribute to hijack form submission, exfiltrating admin token to a same-origin endpoint.