So lets say we have a website where they use htmlentities and everything like < > " & is escaped but not ' (single quote), but the problem is the only input available inside a tag is inside a value="ourinput" but since we can't use " and we can only use ' then i can't escape from inside of value
what should i do? they gave us this website as a homework for XSS and i doubt we have to exploit the web server, but either way the webserver is Apache/2.4.29 and i know this version has a exploit but i couldn't find what exactly is the exploit, the CVE doesn't have detail
so basically there is nothing i can do if they use htmlentities and the only input available is between tags and the ones that are inside tags are surronded by " "?
the previous answers regarding this question was only if the web page is UTF7 we can exploit it, but its UTF8
and to clarify again, our input is only inside a tag for example < tr >ourinput< / tr > and one instance of being inside a tag attribute < a value="ourinput" > and i don't have access to the web server or source code of php
i also tried encoding the input with String.fromCharCode and with &#number but didn't work