This question already has an answer here:
- exploiting XSS in jQuery selector 1 answer
Is this code vulnerable to DOM based XSS?
The application is using jQuery 3.3.1 and i noticed that Data is read from
window.location.hash and passed to
$() via the following statements:
var hash = window.location.hash.substring(1); var elem = $('#reports_nav_links .' + hash);
The link I have is something like
Every parameter I insert after the hash symbol gives the following error in browser console:
Error: Syntax error, unrecognized expression: #reports_nav_links .injection-point
What payload could I use to trigger an alert box or execute any JS code? Is this code vulnerable or 100% safe?