json xss scenario json request site.com/json.php?param=<xss can go here> html page script json_url = site.com/json.php?param=shop json = get_json(json_url) parse_json (json) I can't modify the json_url in the page as it is hardcoded. The html page has no XSS to manipulate the json_url once page is loaded. If I could I would have it request site.com/json.php?param=<dom xss> and that would be easy XSS.
Comments