I have input box with
maxlength=12, and that input box is vulnerable to xss.
But because of maxlength 12 it is not possible to construct any really valid xss vector. The user input is stored in the attribute
value="user input". When the user intercepts the post request with burpproxy, he can change post parameters and cause xss.
Now my question is it is possible to make a post request from other site which bypasses the maxlength element. On my exploit attempts, it takes me to the page where input box is located, and it cuts off everything past the 12th character.
Can that post request be forged and maxlength bypassed to exploit the xss issue?
This is form search on page with maxlength :
This is my try to exploit it from my page:
When I click exploit page button it just sends me back to the main page and input is cut off at the 12th character.