Characters allowed to break double quotes

1

Characters allowed to break double quotes in the action attribute

Created on: Sunday, June 30, 2024 at 12:02:09 PM

Updated on: Friday, March 7, 2025 at 9:44:35 AM

Vector type: XSS

Vector charset: UTF-8

<form id="test" action="aaa$[chr]onsubmit=alert(1)><input/type='submit'>

var form = document.getElementById("test");
if (typeof form.onsubmit === 'function') {
log(String.fromCharCode($[i]))
  }