writeups.xyz / Bug Writeup: Stored XSS to Account Takeover (ATO) via GraphQL API

Submitter : c2a

Date: 29 June 2023

Bounty : undisclosed

Vulnerabilities :

• Stored XSS
• CSP Bypass
• Account Takeover
• GraphQL

Programs :

• Undisclosed

Authors :

• Peter M (@Pmnh_)

Link :
https://www.pmnh.site/post/witeup_lhe_graphql_stored_xss/