4

A comment on another question stated (quite simply):

There are ways in which XSS and SQLi can be used together.

This one is new to me, and I'm curious to hear what additional attack vectors might open up on a website that is doubly vulnerable to both of these attacks. The only use case I can think of is if the SQLi vulnerability is present on pages that can only be accessed by authorized users: in that case the XSS might get you the privileges you need to make SQLi happen. However, it is probably going to be impossible to find such a vulnerability without being authenticated yourself (in which case you don't need XSS), so I don't imagine that is the scenario the original commenter had in mind.

Any other thoughts on how these two might build off of eachother and accomplish something together that might not be possible for one of these vulnerabilities individually?

  • Have you asked the person who made the comment? I would be interested to know as well :) – ISMSDEV Aug 10 '17 at 14:21
  • The original question the comment was on is now closed, although it doesn't look like that will stop me from pinging him and asking. – Conor Mancone Aug 10 '17 at 14:49
  • I think the answers given here are pretty thorough and include what I had in mind, so there's nothing I could add. – Arminius Aug 10 '17 at 16:05
8

There are two ways that XSS and SQLi could interact. The comment you quoted is from this question and is clearly regarding the first point.

SQLi via XSS

If you know that an application is vulnerable to SQL injection, but you do not have the permissions necessary to access the vulnerable component, you may be able to leverage an existing XSS vulnerability and thus get a more privileged user to perform the SQL injection for you.

As you point out, finding vulnerabilities in components that you do not have access to may not be that easy. There are still at least two cases where this can easily happen though:

  • Open source software
  • Temporary access to the source code (maybe via an external auditor, via Email leaks, via a disgruntled ex employee, via vulnerabilities in your source control, ...)

For very simple injections, an attacker may also just guess an attack (maybe an attacker knows that your application doesn't defend against SQLi at all, but all injections in components they have access to are using a database user with restricted permissions; here they might actually be able to guess script- and parameter names of other components and exploit those via XSS).

Theoretically, you could also imagine a setup where more privileged users are always using a database connection with a more privileged database user, so even an injection in public components may be more powerful if exploited via a more privileged user through XSS.

The last examples are a bit contrived, but certainly possible. There are likely other examples as well.

XSS via SQLi

In this case, you have an SQL injection, but cannot actually achieve anything interesting with it. The injection may take place with a very restricted database user, who for example can only read out already publicly available data (but cannot read out other data, write data, write or read system files, execute commands, etc; there are also no vulnerabilities in the dbms you can exploit).

In this case, you might be able to perform a reflected or stored XSS attack via SQLi.

  • 1
    The first case is indeed what I was referring to in my comment. A practical example are the frequent authenticated SQLis and RCEs in Wordpress plugins. They can be triggered by an authenticated user only, so an additional XSS flaw would help to leverage them. – Arminius Aug 10 '17 at 15:59
  • 1
    Thanks guys, this is great info to file away for later. Good ol' wordpress: making it easy for servers to get hacked since 2003. – Conor Mancone Aug 10 '17 at 17:17
2

One example:

  • forum where everybody can post comments
  • comments get sanitized before they get put into the database, i.e. any attempts to include script will be detected
  • SQLi allows direct access to the DB and thus makes it possible to add a comment which is not sanitized or modify in existing comment this way - and this way add script into the comment
  • forum system assumes sanitized comments in DB and will just show the comment as stored in the DB, i.e. including the script -> stored XSS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.