0pilatos0 / datahunt-server Goto Github PK

if the username starts with a script tag and ends with a closing tag it will execute the code inside the tag

1: create a new account
2: make your username something along the likes of <script>alert("Hello DataHunt")</script>
3: verify your account
4: log into your account now
5: now you see the alert :)

:D

When creating your account there is no check for duplicate usernames. If your username is already taken it will instead of telling you crash the server.

Recreate:
Go to datahunt.duckdns.org/game
Create an account
Create another account with the same name

it should have now crashed your server