So I've been fooling around login form on one site and discovered that " is not escaped and so typing " in field would close value of value part of input. Typing " /> would close input tag. I tried to type
- Code: Select all
" /> <?php echo 'lulz'; ?>
but php got commented out
after some little research I found out that php code can be also embedded using
- Code: Select all
<script language="php">echo 'lulz';</script>
so I tried injecting this instead of first option. It got injected just fine but didn't output a thing. Why?
Also, there is place on that site is vulnerable to xss through bbcode
- Code: Select all
[img][url=jscodehere]wtf[/url][/img]
