Cross-site Scripting (XSS) - DOM (CWE-79)CVSS 7.5
XSS Bypass to Zero Click Account Takeover in AI Chatbot
Poor HTML sanitization combined with a file upload feature led to a stored XSS that allowed administrator accounts to be compromised.
Application Overview
Let’s refer to the company as A.Corp.
Instead of integrating a third-party chatbot, A.Corp developed its own AI assistant from the ground up:
- The model was trained internally.
- The user interface was custom-built.
- The guardrails and safety controls were implemented by their team.