Summary
The Name field in the user profile accepts URL-formatted input without enforcing validation consistent with the expected purpose of the field. During testing, a URL was accepted and stored as the user's name.
Technical Description
The profile update functionality does not validate that the Name field contains values matching the expected format for a person's name. Instead, arbitrary URL-formatted input is accepted.
Affected Endpoint
https:
Steps to Reproduce
Log in to an account.
Navigate to the profile page:
https:
In the Name field, enter:
https:
Save the profile.
Observe that the value is accepted and stored without validation.
Working Proof of Concept
Payload
https:
Observed Result
The application accepts the URL as the user's name.
No validation error is displayed.
Expected Result
The application should validate the field according to its intended purpose.
If only personal names are expected, values that do not match the allowed format should be rejected with an appropriate validation message.
User Impact
User profile data may become inconsistent or malformed.
The application may display unexpected values in places where a person's name is expected.
Business Impact
Reduced data quality.
Potential downstream display or processing issues if other systems assume the field contains a person's name.
If the value is later rendered in another context without proper output encoding or validation, additional security risks could arise.
Remediation
Apply server-side validation appropriate for the Name field.
Define an acceptable character set and length based on business requirements.
Continue to perform context-appropriate output encoding wherever user input is displayed.