The XSS vector is at the * but the function issue_type is not declared hence my payload is not getting executed.
following is the instance of the vulnerable code:-
<select name="sub_subissues" id="_subsubissues" onchange="issue_type(this, *)" style="height:30px;">
so I tried:-
issue_id=alert(1)
which resulted into:-
<select name="sub_subissues" id="_subsubissues" onchange="issue_type(this, alert(1))" style="height:30px;">
as function issue_type is not defined in the page the payload did not execute as the onchange attribute did not execute.
The characters <>&"'
cannot be used as they are encoded
How can i modify my payload to exploit xss?
issue_type
fun is not defined on the page. Your payload is not executed. The solution is to defineissue_type
fun yourself and include yourpayload
. MDN Web Docs: Introduction to events, Functions, OWASP: XSS.