Tag Info

New answers tagged

0

Yes it is vulnerable to DOM based XSS .You can look at this Wikipedia example to learn how can attacker use this vulnerability gain access on victim's browser.


0

By looking at the code, I assume that the user is entering the URL parameter into a form. As @SilverlightFox said, an attacker could enter javascript:alert('xss') in the form, and that would execute the JS, but only in his browser. Since the URL parameter is not part of the URL of the website (either as a GET parameter or somehow else) and is not stored ...


0

Yes, it is vulnerable if document.theform.reference[id].value can be a value controlled by another user. If this value was set to javascript:alert('xss') by an attacker then the line window.location.href = url; would cause the script to be executed in the context of the current domain for whichever user is currently using the site.


0

A fairly comprehensive resource can be found here and here.



Top 50 recent answers are included