Humorous XSS Vulnerabilities in a Movie Website

Here’s another follow-up article. I’ll be sharing more vulnerabilities I discovered on a popular Turkish movie website, which I mentioned in my previous post. This website attracts mora than 10 million unique monthly visitors.

Vulnerabilities can sometimes bring huge surprises. Although they pose a significant security risk, they can occasionally be a source of amusement.

I want to discuss how the feature that allows users to add movies to their profiles is susceptible to manipulation.

The system’s logic involves creating a new list from the “Create New List” section in the user profile, naming it, and then adding movies and TV series to curate a personalized list. This list is then published on your profile. However, due to a critical oversight by the developers, it’s possible to upload XSS payloads into the list’s title field using a simple trick.

In the first example, I attempted to play an audio file from a remote site — and succeeded. The lack of a character limit for the list title made my task even easier. Using the payload below, I managed to add a funny sound from the myinstants website.

For the sound to play, the user needs to click anywhere on the body of the page. Modern…