0

I have a function like this where json is a json object that is in this form err: someNumber, and I want to inject javascript into that alert so that maybe i could inject ajax in there or something else, how would I go about doing that?(If it's even possible)

function imageShow(json) {
if (json && 'err' in json && json.err != "" && json.err != "200" && json.err != "OK")
    {
        alert (json.err);
    }
}

For example:

let json.err be { "err" : "<script> alert(\"Hey\");</script> }. and then I could use that alert within the alert.

If not, I have this same function with this Same json data and same everything, but instead of alerting, it changes a picture's source to the json.err: Could I inject something into this?

function imageShow(json) {

if (json && 'err' in json && json.err != "" && json.err != "200" && json.err != "OK")
    {
        $("#img")[0].src = json.err;
    }

}
  • You write "let json.err be { "err" : "<script> alert(\"Hey\");</script> }" - did you mean "let json.err be "<script> alert(\"Hey\");</script>""? – Arminius Apr 21 '18 at 15:39
  • yes that's what I meant. – Guysudai1 Apr 21 '18 at 15:46
1
  • The message in an alert() box is always displayed as plain text. You can't inject code here.

  • Setting the src of an image to a user-controlled value can't lead to XSS, but some other less severe vulnerabilities as explained in this thread.

  • Check my edit, I added another thing I hope I can inject – Guysudai1 Apr 21 '18 at 15:32
  • 1
    @fdsaddsa I amended my answer, but generally please don't extend your question after receiving answers. Instead, you can ask a new question (after checking that it hasn't been asked before). – Arminius Apr 21 '18 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.