0

Is it possible to extract CSRF-token by using inline-CSS injection (inside style attribute)? (It seems to be impossible, because it is not possible to define CSS classes inside attributes.)

<p style=<?php echo htmlspecialchars($_GET["css-injection-here"]); ?>>wubwub</p>

It seems that internet knows only about stealing CSRF-tokens with CSS-injection which happens inside <style> tags:

<style>
<?php echo htmlspecialchars($_GET["css-injection-here"]); ?>
</style>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.