Skip to content

Instantly share code, notes, and snippets.

@lauritzh

lauritzh/vue-csti.php

Created September 21, 2022 18:41
Show Gist options
  • Save lauritzh/7d658ea2880cd7d743882054c8210e30 to your computer and use it in GitHub Desktop.
Save lauritzh/7d658ea2880cd7d743882054c8210e30 to your computer and use it in GitHub Desktop.
Download ZIP
Vulnerable VueJS 3 Client-Side Template Injection example
Raw
vue-csti.php
<!--
//
// Vue 3 XSS example
// 1. Launch as follows:
// $ php -S 127.0.0.1:1234
// 2. Access at http://localhost:1234/vue-csti.php?name=you and try to pop an alert!
//
// (c) Lauritz Holtmann
//
-->
<html>
<head>
<title>XSS</title>
</head>
<body>
<script src="https://unpkg.com/vue@3/dist/vue.global.js"></script>
<div id="app">
<?php
$name = $_GET["name"] ? htmlentities($_GET["name"], ENT_NOQUOTES) : "there";
print_r("Hey " . $name . "!");
?>
</div>
<script>
const { createApp } = Vue
createApp({}).mount('#app')
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment