Lab 66 — GrowthPilot — Stored XSS via User Registration

hackadvisor

Task: Workforce management SaaS with user registration reviewed by admin bot; fullName field is HTML-escaped on user dashboard but rendered unescaped in admin panel. Solution: Stored XSS via img onerror in fullName field, cookie exfiltrated via base64-encoded URL path to Interaction Server (query strings stripped from logs).