A company was compromised by chaining an IDOR vulnerability in a support ticket API with a blind XSS vulnerability in the internal ticket management system. The attacker leveraged blind XSS to extract ticket IDs (which were otherwise hard to brute-force), then used IDOR to access a password reset ticket from Slack that contained registration links to company channels.
Walkthrough of discovering a blind XSS vulnerability using XSS Hunter and Burp Suite by injecting a malicious payload into the Referer header, which was stored and later executed when accessed by administrators or logged-in users.
A researcher discovered a blind XSS vulnerability in GoDaddy's internal customer support panel by injecting XSS payloads into user profile fields (first/last name), which executed when support agents accessed the CRM system. The vulnerability allowed arbitrary actions on customer accounts including domain transfers and account deletion, demonstrating how data poisoning can compromise backend systems drawing from shared data stores.