Submit and Execute Weaponizing Reflected XSS in Siemens Team...

src/pentesting-web/xss-cross-site-scripting/README.md

@@ -74,6 +74,14 @@ If your input is reflected inside the value of the attribute of a tag you could
 3. If you **cannot escape from the attribute** (`"` is being encoded or deleted), then depending on **which attribute** your value is being reflected in **if you control all the value or just a part** you will be able to abuse it. For **example**, if you control an event like `onclick=` you will be able to make it execute arbitrary code when it's clicked. Another interesting **example** is the attribute `href`, where you can use the `javascript:` protocol to execute arbitrary code: **`href="javascript:alert(1)"`**
 4. If your input is reflected inside "**unexpoitable tags**" you could try the **`accesskey`** trick to abuse the vuln (you will need some kind of social engineer to exploit this): **`" accesskey="x" onclick="alert(1)" x="`**
 
+#### Auto-submitting forms and the `formdata` event
+
+If untrusted request data breaks out of a quoted attribute on an auto-submitting `<form>`, it can add an `onformdata` handler to that form. The `formdata` event fires when the browser constructs the form's submission entry list, so the page's own scripted submission can run the handler without a further click. The cited case confirmed this in Firefox; check other browser engines separately.<sup>[[25]](#references)[[26]](#references)</sup>
+
+Direct `HTMLFormElement.submit()` does **not** dispatch the `submit` event, but `formdata` can still fire during entry-list construction. This distinction matters when assessing a reflected attribute in a login or SSO redirect that submits itself on load.<sup>[[25]](#references)[[26]](#references)[[27]](#references)</sup>
+
+Related impact boundaries are covered under [CSRF](../csrf-cross-site-request-forgery.md) and [account takeover](../account-takeover.md).
+
 #### Attribute-only login XSS behind WAFs
 
 A corporate SSO login page reflected the OAuth `service` parameter inside the `href` attribute of `<a id="forgot_btn" ...>`. Even though `<` and `>` were HTML-encoded, double quotes were not, so the attacker could close the attribute and reuse the same element to inject handlers such as `" onfocus="payload" x="`.<sup>[[1]](#references)</sup>
@@ -2101,5 +2109,8 @@ other-js-tricks.md
 - [22] [pfSense pfBlockerNG - vulnerable DNS reply conversion and logging code](https://github.com/pfsense/FreeBSD-ports/blob/a621624266b19a7f48b1f94a60821d2c2fc6ee4c/net/pfSense-pkg-pfBlockerNG/files/usr/local/pkg/pfblockerng/pfb_unbound.py)
 - [23] [pfSense pfBlockerNG - vulnerable report rendering code](https://github.com/pfsense/FreeBSD-ports/blob/a621624266b19a7f48b1f94a60821d2c2fc6ee4c/net/pfSense-pkg-pfBlockerNG/files/usr/local/www/pfblockerng/pfblockerng_alerts.php)
 - [24] [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)
+- [25] [Bishop Fox - Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect](https://bishopfox.com/blog/xss-siemens-teamcenters-login-redirect-cve-2026-58113)
+- [26] [MDN - HTMLFormElement: formdata event](https://developer.mozilla.org/en-US/docs/Web/API/HTMLFormElement/formdata_event)
+- [27] [MDN - HTMLFormElement: submit() method](https://developer.mozilla.org/en-US/docs/Web/API/HTMLFormElement/submit)
 
 {{#include ../../banners/hacktricks-training.md}}