5-Minute Bug Bounty: How a Simple HTML Injection in ‘Submit Request’ Led to Email Response Disclosure + Video

By /

Listen to this Post

Featured Image

Introduction:

HTML injection occurs when an attacker is able to inject arbitrary HTML code into a web application’s output. In the reported scenario, a bug hunter discovered that a “Submit Request” feature reflected injected HTML directly into an email response sent to the user. This type of injection—especially when email clients render HTML—can lead to information disclosure, phishing, or session hijacking. Within five minutes of testing on a BugRap (bug bounty platform) target, the researcher successfully demonstrated the impact by seeing their injected markup appear inside a transactional email.

Learning Objectives:

  • Understand how HTML injection manifests in web forms and email notification systems
  • Learn to identify and exploit email-based HTML injection using manual and automated techniques
  • Apply mitigation strategies including input validation, output encoding, and email content security policies

You Should Know

1. Understanding HTML Injection in Email Responses

When a web application takes user input from a form (e.g., “Submit Request” with fields like name, message, or ticket ID) and includes that input verbatim in an email sent to the user or an admin, an attacker can inject HTML tags. If the email client renders HTML (most modern email clients do by default), injected elements like `` or `Click` become active.

Example vulnerable backend logic (pseudo-code):

 Flask example – vulnerable
message = request.form['user_message']
send_email(recipient, f"Your request: {message}")

No sanitization means `