I'm testing a website, which is vulnerable to XSS.
<input type="hidden" id="referer" name="referer" value="INJECTION_POINT"> <script> document.referer = referer.value </script>
This is the whole context.
document.refereris being used nowhere else. (note, that it's
refererhere and not
"is being deleted. There is no vulnerability in the way it gets deleted. There is no encoding possible, and no unicode normalization happening.
Since escaping from the tag or from the attribute value is not possible. You'd have to do something with the value. But as far as I understand it, in this case, I'm not controlling an event, just a variable assignment, for a variable which does not get used anywhere. Is my understanding incorrect?