Stored XSS in eBay’s Sell Page

// TL;DR

---

The finding

The vulnerability lived on eBay’s Sell page, in the “add photos” field. Like a lot of XSS, the issue was that input tied to that field was reflected into the page without being properly neutralised — so instead of being treated as data, it was parsed as HTML and executed.

The payload

The payload that fired was a classic image-tag injection:

<img src=x onmouseover=alert("XSS")>

The idea is simple: supply an <img> tag pointing at a source that will fail to load (src=x), and attach an event handler. When the broken image renders and the user’s cursor passes over it, the onmouseover handler runs — and the script executes in eBay’s context.

Why it works

This payload is a staple for a reason: it sidesteps the most common first line of defence.

Plenty of filters focus on blocking <script> tags specifically. But XSS doesn’t need <script> — any element that can carry a JavaScript event handler will do. An <img> tag with onmouseover (or onerror, onload, and others) executes script without the word “script” appearing anywhere. Using src=x guarantees the image fails, which is a reliable way to trigger handlers like onerror, and onmouseover triggers on simple user interaction.

The underlying lesson is the one that runs through every XSS writeup: safety comes from encoding output for its context, not from blacklisting a handful of “dangerous” tags.

Report & recognition

I reported the vulnerability to eBay. Their team confirmed and fixed it, and acknowledged the report.

It was a genuine milestone for me to be listed in eBay’s Security Researchers Acknowledgments — their recognition for researchers who have reported high-risk vulnerabilities to the company.

Thanks for reading — happy hacking!