Other nomination
New PHPIDS vector
A PHPIDS bypass using IE's language attribute to declare an event handler as VBScript, a very old feature never used in XSS and absent from the cheatsheet. VBScript needs no parentheses to call a function and the plus sign coerces the argument, which removes the need for quotes inside the attribute. IE8's XSS filter catches it.
Record
- Researcher
- Gareth Heyes
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.