Characters allowed to break double quotes

1

Characters allowed to break double quotes in the action attribute

Created on: Sunday, June 30, 2024 at 12:02:09 PM

Updated on: Wednesday, November 20, 2024 at 8:36:50 PM

Vector type: XSS

Vector charset: UTF-8

<form id="test" action="aaa$[chr]onsubmit=alert(1)><input/type='submit'>

var form = document.getElementById("test");
if (typeof form.onsubmit === 'function') {
log(String.fromCharCode($[i]))
  }