1

There is an option to set date range through URL address bar like this

domain.tld/process/date_range:2017-04-13%7C2017-05-02

GET parameter is parsed in PHP like this

    ...
<?php if(isset($dateTo)): ?>
    endDate: moment("<?php echo $dateTo; ?>", "YYYY-MM-DD"),
<?php else : ?>
    ...

and the this is echoed directly to javascript

<script>
$(document).ready(function() {

    $('#r').daterangepicker({
        startDate: moment("2017-04-01", "YYYY-MM-DD"),
        endDate: moment("2017-05-1", "YYYY-MM-DD"),
        ...

so i am trying to modify GET param by adding

")%7D);console.log(1234);});

then i am able to get

<script>
$(document).ready(function() {
    $('#r').daterangepicker({
        startDate: moment("2017-04-13", "YYYY-MM-DD"),
        endDate: moment("2017-05-02")});console.log(1234);});", "YYYY-MM-DD"),
        ...

but line

endDate: moment("2017-05-02")});console.log(1234);});", "YYYY-MM-DD"),

generates syntax error and then console.log(1234) is not interpreted.

How can I get that working?

its internal project

2

You code has at least one closing bracket too much. You need to properly comment out the junk at the end (with // or /*):

        endDate: moment("2017-05-02")});console.log(1234);});", "YYYY-MM-DD"),
                                                             |---------------|

But in your example, the easiest XSS payload would just be:

",console.log(1234),"

Instead of adding an extra statement, this injects console.log as an expression.

If you don't want to mess with the Javascript syntax (and angle brackets are permitted), you can also just close the script block and open a new tag, like so:

</script><svg/onload=console.log(1234)>

This works because the syntax error you're producing in the previous script doesn't block other independent scripts on the site from executing.

(Slashes can be URL-encoded as %2f and newline characters as %0a or %0d%0a, respectively.)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.