Hi.
Our pentesters discovered a Cross Site Scripting vulnerability that I was able to trace back to pqselect.
If you set one of the option's names in multiselect to something like that:
somevalue%27%22%3E%3C%2Ftextarea%3E%3Ch1+onclick%3Dalert%28document.domain%29%3EXSS1
unescaped version:
somevalue'"></textarea><h1 onclick=alert(document.domain)>XSS1
PQSelect will generate the unescaped version that can be executed. That is because it uses innerText instead of innerHtml (.text() vs .html() in jquery).
I'll be submitting a pull request.
Hi.
Our pentesters discovered a Cross Site Scripting vulnerability that I was able to trace back to pqselect.
If you set one of the option's names in multiselect to something like that:
unescaped version:
PQSelect will generate the unescaped version that can be executed. That is because it uses innerText instead of innerHtml (.text() vs .html() in jquery).
I'll be submitting a pull request.