Converting Self-XSS to Stored XSS leads mass Account Takeover (ATO)
The attacker initially discovered a Self-XSS vulnerability by misusing the application features it got critical impact. Although harmless in browser, this input was later stored and rendered elsewhere without sanitization, escalating it to a Stored XSS. Since the payload executed in every user’s session, it could hijack authentication tokens or cookies.
Parth Narula
