HTML Injection in DAST Trial Request Form Confirmation Email – PortSwigger

Summary

The DAST trial request form at https://portswigger.net/burp/dast/trial is vulnerable to HTML injection through the "First Name" field. User-supplied input is not properly sanitized before being inserted into confirmation emails, allowing attackers to inject arbitrary HTML content that gets rendered in the victim's email client. This vulnerability can be exploited to conduct sophisticated phishing attacks that appear to originate from PortSwigger's legitimate email infrastructure.

Steps to Reproduce

1. Navigate to https://portswigger.net/burp/dast/trial
2. Locate the "Request a tailored demo" form
3. Fill in all required fields with legitimate data
4. In the "First Name" field, insert the following payload: