Multiple XSS Vulnerabilities in Sharekhan trading Portal ( https://strade.sharekhan.com )

Vulnerability Description:

Sharekhan(Indian Stock Trading Portal) provides it’s user to trade in stock market & Manage their DP account also. Being in finance domain it should be secure & vulnerability free but it’s online portal “https://strade.sharekhan.com/” contains multiple XSS ( Cross site scripting) vulnerabilities those can be used against the site users for fishing & information gathering & can be turned to their financial losses . I have tried to contact the sharekhan but didn’t got any positive response yet. So I am reported these vulnerabilities to the cert.in for further action & co-ordination with sharekhan site administrator.

These are fairly simple to discover & exploit.

Type of vulnerability : Input validation ( XSS)

Product: Sharekhan trading Portal

POC :

(User login Required )

https://strade.sharekhan.com/rmmweb/adminpcs.sk?verify=<script>alert("sharekhan pwnd2!")</script>&cid=e69da5e2d0abdf87cd1315e04a85e8f84041f9a23e279914e9dc6d274f45bd1d&sid=07b5b5b79ae54d622c869d61eea3a1add607426665b97512

(User login is not required)

https://strade.sharekhan.com/rmmweb/AdminLoginServlet.sk?error=Your+Session+%3Cscript%3Ealert%28%22sharekhan pwnd2!%22%29%3C/script%3Esoniji+expired%2C+please+login&caller=https%253A%252F%252Fstrade.sharekhan.com%252Frmmweb%252Fadminpcs.sk%253F