jQuery XSS via DOM manipulation of untrusted HTML containing <option> elements

This repository is a proof-of-concept (POC) environment for demonstrating CVE-2020-11023, a cross-site scripting (XSS) vulnerability in jQuery 3.4.1. The repository contains a Dockerfile and docker-compose.yml for easy setup of a vulnerable PHP web application. The main application (src/index.php) accepts user input via POST and directly injects it into the DOM using jQuery's .html() method, which is vulnerable to XSS. The README provides example payloads and mitigation strategies. The application is intended for educational and testing purposes only, and should not be used in production. The main exploit capability is browser-based XSS via injection of arbitrary JavaScript. The main endpoints are the local web server (http://localhost:8080) and the externally loaded jQuery library.

This repository is a proof-of-concept exploit for CVE-2020-11022 and CVE-2020-11023, which are cross-site scripting (XSS) vulnerabilities in jQuery versions prior to 3.5.0. The repository contains two files: a README.md with detailed exploitation instructions and an index.php file that serves as a vulnerable web application. The exploit demonstrates how an attacker can inject arbitrary JavaScript via the 'value' URL parameter, leading to XSS and cookie theft. The attack is performed by hosting index.php on a PHP webserver with a vulnerable jQuery version, then visiting a crafted URL and triggering DOM manipulation via a button. The exploit also shows how to exfiltrate cookies to an attacker-controlled server. The repository is structured as a simple, educational POC and does not include weaponized or automated exploitation features.