Challenge 14/36: Self-XSS in Profile Bio with CSRF Vulnerability

Challenge 14/36 · Cross-Site Attacks. Self-XSS in profile bio. Easy · Injection · 20–30 min. A Self-XSS in the profile bio editor is harmless on its own. Chain it with a missing CSRF token on the update endpoint and you get cross-user profile takeover. Spin up the lab: npx create-oss-store my-ctf-lab. See it on the roadmap at https://koadt.github.io/oss-oopssec-store/roadmap#challenge-14. Walkthrough available at https://koadt.github.io/oss-oopssec-store/posts/self-xss-csrf-profile-takeover — spoilers, read it once you are stuck. Star OopsSec Store on GitHub at https://github.com/kOaDT/oss-oopssec-store