I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a javascript-containing file onto the origin via an attachments feature, but it looks like a dead end.
Since I can't execute javascript, what can I use as a proof of concept to show the continued severity of HTML injection attacks despite the CSP? Are there any HTML tags I can still use to compromise security?
The CSP has a default rule that only allows the same origin. However, there are exceptions for data:
in <img>
, and the policy also allows inline CSS.