I am trying to perform XSS on the injection point marked with XXXX
here:
<div>
<textarea name="billing[something]" id="billing-something" rows="1"
type="phone" title="something" placeholder="something" cols="80">
XXXX
</textarea>
</div>
I can reflect any input, except <
or >
. All characters after those will be removed. Can I perform any kind of XSS?
Example:
- If i introduce
XXXX>XXXX
I will obtainXXXX
XXXX[[>]>///
I will obtainXXXX[[
XXXX[[<]<///
I will obtainXXXX[[
In other places in this application I was able to exploit inputs using payloads like
nsehe"onfocus="alert(1)"autofocus="e2c00
because of <input value="..
fallback.