XSS vulnerability on linkifyURLs = 2

Question

From evn.com on October 06, 2011 09:18:46

using: http://shellinabox.googlecode.com/svn/trunk/demo/demo.html but with linkifyURLs = 2 (instead of 1), print:

print "javascript:'.3.3.7/http://',alert(1);

it will create a link that when clicked will execute an alert.

Original issue: http://code.google.com/p/shellinabox/issues/detail?id=144

该提问来源于开源项目：shellinabox/shellinabox

Answer 1

From evn.com on October 06, 2011 00:24:51

I meant:

print "javascript:'.3.3.7/http://',alert(1);