Sploitus

Exploit for Cross-site Scripting in Jqueryui Jquery Ui

CVE-2021-41184

githubexploit · 2022-04-14

Exploit Code

README36 lines
## https://sploitus.com/exploit?id=1B40C229-6EF5-56E6-8AC3-08B7A112F806
# Exploit-Medium-CVE-2021-41184

Exploit Medium	CVE-2021-41184 XSS in the `of` option of the `.position()` util

1. jQuery ui version v1.12.1 vulnerable

1.1 https://www.website.com/_js/jquery/jquery-ui-1.12.1/jquery-ui.min.js



------------------------------------------------Concept proof---------------------------------------------------------------



1. Open url 

2. Open inspect 

3. Look for some ID in site elements

3.1 #ID

4. Go to console tab

5. Inject script with ID selected at point 3.1

5.1 Script


	$("#id").position( {
	my: "center",
	at: "right bottom",
	of: "",
	collision: "none"
        });