Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Cross Site Scripting (DOM based)

Trafalgar | Last updated: Mar 31, 2021 04:29PM UTC

Burp has created two different tentative DOM XSS issues with this description: "The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to $() via the following statement:" Note: The exploitability of this issue might depend on the specific version of jQuery that is being used. (jquery1.10.2) And these are the statements: $(".dot-nav li a[data-show-slide="+ location +"]").parent("li").addClass("active"); and $(".slide-" + location).addClass("active"); I'm trying to imagine which scenario this would be exploitable. It seems to be a false positive because the variables path and var1 will get the literal value and won't trigger any JavaScript code. Could you please give me a scenario where this could be exploitable? Thanks!

Uthman, PortSwigger Agent | Last updated: Apr 01, 2021 02:21PM UTC