Google Bump Vulnerable To Presistent XSS

I Have Found 3 Presistent XSS in google Bump (bu.mp)

Firstly I Wanna Explain Whats Bump Is

Bump Is A App Where We Can Transfer Files By Shacking Two Phones At The Same Time

is'nt it cool  ?

Its Same As Air Drop For  Iphone


This Is Bump Site https://bu.mp/


For Website We have To Press space And  Shake The Android Phone

Firstly I Downloaded Android Bump App 

 Changed My First Name To <img src=x onerror=prompt(1)>

And Last Name to <img src=x onerror=prompt(2)>

I Tried To Connect My Phone To Website with pressing space and shacking phone .

I Got Connected To Website ..

i Got my first Presistent XSS 

While Connecting 

Here Is The POC !

Now Here is Second Presistent XSS
I Changed My First Name To <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>

after Connected I tried to transfer files from pc !

an upload box opened 

where it was return "Send to X"

Then I Click On X ... i Got XSS popup ... This Is because Of The First Name Which Had Put "<a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>"



Here Is The POC 

Now Here Is The Third Presistent XSS


Then I Have Sent A Photo 

And Named The Album As  ">>>>>>>>>>>>>><<<<<<<<<<<img src=x onerror=prompt(1)>


And Clicked On Share Button 

Then I Got The XSS popup 

But This Three Bugs Have Been Rejected by Google :(
Because Bump Is A New acquisition

But They Gave Me Hall Of Fame ^_^

Thanks To Google Security Team  :)