I'm a student in college. We have a learning platform with a UI which gives you Windows Vista vibes. I've found a way to inject Javascript in the homepage, but it's not possible on the other pages. I'm able to add a stylesheet, and effectively changing the look of my homepage, but would love to be able to do so too in the rest of the site. I've found ways to store values in your browser, using a LocalStorage obj or document.cookie, but this doesn't give me the ability to add js itself, which autoruns on load of the page. Is there any way to do this? Thanks for helping out :))
Great find!
It may be possible to turn the website into a SPA (Single Page Application) by intercepting the clicks on links (<a> elements with href attributes), using history.pushState to change the url without reloading and then loading the site manually using fetch/xhr and then insert the resulting body into the current page, however my personal recommendation would be to use a userstyle browser extension and report the (self-)xss issue instead ;)