Published 16 years 11 months ago • Last updated March 22, 2025 • ⏱️ < 1 min read
No new PHPIDS vectors for a while? So I thought I'd write a new one as I had 5 minutes spare while drinking my coffee. I used a new technique (as far as I'm aware) to make things easier :) A very old feature in IE is to allow events to be declared as vbscript using the language attribute. This has been used in some very old code but never in XSS, it's definitely not on the cheatsheet.
Anyway here is the vector:-
<pre lang="javascript"> <b/alt="1"onmouseover=InputBox+1 language=vbs>test</b> </pre>[POC](http://demo.phpids.org/?test=%3Cb/alt=%221%22onmouseover=InputBox%2b1 language=vbs%3Etest%3C/b%3E)
You have to rollover the bold "test" on the page to execute and allow scripted windows. The errors are related to the dom injections that are not valid because it's a HTML injection. You could get round the scripted windows dialog by using other code but I only had 5 mins.
VBScript doesn't require () to call functions and the plus converts 1 to a number (which it already is), this is used to bypass the need to use quotes within that particular attribute.
Note the XSS Filter in IE8 catches this vector.