Injection :: Stored Cross Site Scripting


Problem Statement

The GraphQL mutations createPaste and importPaste allow creating and importing new pastes. The pastes may include any character without any restrictions. The pastes would then render in the Public and Private paste pages, which would result in a Cross Site Scripting vulnerability (XSS).

Resources
Exploitation Solution