PWN Rules!

 

Unexpected Presistent XSS in Yahoo Mail Inbox

This one affected the mobile version: https://mg.mail.yahoo.com/neo/m/launch

Just send an email to the victim and make the content of the email is your payload

Once the victim open his email and go to Inbox, the code will be executed, The severity of this vulnerability was in executeing the code without opening the email you sent

Unexpected, Right?

 

Video:

Timeline:

Nov 11th 2015: Vulnerability reported

Nov 11th 2015: Report triaged

Nov 21st 2015: Resolved

Thanks